This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Information Systems Security Officer (ISSO) based in the United States.
The Information Systems Security Officer will play a key role in strengthening cybersecurity and maintaining the security posture of cloud-based platforms supporting U.S. government and defense environments. This position focuses on executing the Department of Defense Risk Management Framework (DoD RMF) lifecycle and maintaining system authorizations across IL4 and IL5 environments. The successful candidate will oversee authorization packages, continuous monitoring activities, vulnerability remediation, and compliance documentation to ensure systems remain secure and audit-ready. Working closely with Information System Security Managers, assessors, Authorizing Officials, and Product and Engineering teams, this professional will translate complex security requirements into practical technical guidance. The role offers an opportunity to contribute to mission-critical security operations while supporting modern cloud-native technologies and DevSecOps practices. This is a full-time, fully remote position, open only to candidates residing in the approved hiring hubs of Washington, DC/Maryland/Virginia or Denver/Colorado Springs, Colorado.
Accountabilities
• Execute all phases of the NIST SP 800-37 DoD Risk Management Framework lifecycle, including system categorization, control selection, implementation, assessment, authorization, and continuous monitoring for IL4 and IL5 environments.
• Own and maintain end-to-end eMASS authorization packages, ensuring control implementation details, assessment results, supporting evidence, and monitoring status remain accurate and ready for review.
• Manage DISA Ports, Protocols, and Services Management (PPSM) registrations, reconciling ports, protocols, services, data flows, and boundary architecture documentation.
• Develop and maintain System Security Plans, control implementation narratives, Plans of Action and Milestones (POA&Ms), and other RMF documentation that accurately reflects system architecture and operations.
• Lead continuous monitoring activities, including monthly POA&M updates, vulnerability and patch reporting, Information Assurance Vulnerability Management (IAVM) compliance, significant change reviews, and periodic assessments.
• Coordinate with engineering teams to address security findings, track remediation activities, and ensure identified vulnerabilities are resolved within required timelines.
• Validate Security Technical Implementation Guide (STIG) compliance and analyze vulnerability scan results from ACAS and Tenable Nessus, tracking remediation against NIST 800-53 and DoD requirements.
• Serve as a technical point of contact for ISSMs, security assessors, and Authorizing Officials during security assessments, authorization readiness reviews, and audits.
• Collaborate with Product and Engineering teams to map cloud-native security controls across AWS, containers, Kubernetes, and CI/CD pipelines to DoD RMF and NIST 800-53 requirements.
• Translate complex DoD security policies and compliance requirements into actionable technical direction and defensible evidence for engineering teams and stakeholders.
• Maintain authorization readiness and a strong security compliance posture across accredited systems and supporting platform environments.
Requirements:
• 3–5 years of hands-on experience in DoD cybersecurity, RMF authorization, or information assurance, including direct experience in an ISSO or equivalent compliance role supporting DoD Authority to Operate (ATO) packages.
• Demonstrated proficiency building, managing, and maintaining authorization packages in eMASS.
• Working knowledge of DISA PPSM registration processes, including ports, protocols, services, CAL, and system boundary and data-flow documentation.
• Strong practical understanding of NIST SP 800-53 (Revision 4 or 5), NIST SP 800-37 RMF, and DoD-specific cybersecurity implementation guidance.
• Familiarity with DoD security tools, standards, and authorization policies, including DISA STIGs, STIG Viewer, SCC, ACAS, IAVM, DISA Cloud Computing Security Requirements Guide, and continuous monitoring requirements.
• Understanding of modern cloud environments and architectures, particularly AWS, containers, Kubernetes, and CI/CD pipelines, and the ability to map these technologies to technical security controls.
• Strong technical writing skills, with the ability to produce clear, accurate, assessor-ready documentation and control implementation narratives.
• Active U.S. Secret security clearance.
• DoD 8570/8140 IAM Level I or IAT Level II baseline certification, such as Security+, CISSP, or an equivalent qualification, required or obtainable within 90 days.
• U.S. citizenship is mandatory for this position.
• Must reside in one of the approved hiring locations: Washington, DC/Maryland/Virginia or Denver/Colorado Springs, Colorado.
• A proactive, solutions-oriented mindset, with the ability to take ownership, overcome challenges, and deliver measurable results.
• Strong collaboration skills, personal accountability, autonomy, and the ability to work effectively across technical and security teams.
Benefits:
• Annual base salary range of $150,000–$170,000, determined by professional experience, technical proficiency, seniority, and regional factors.
• Eligibility for equity awards through an equity incentive plan.
• Potential eligibility for discretionary bonuses.
• 100% employer-paid medical, dental, and vision coverage for employees and their dependents.
• 401(k) plan with a 3% company contribution.
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, and family planning support.
• Technology and home office stipend for new hires.
• Annual professional development stipend.
• Flexible paid time off, in addition to all federal holidays.
• Generous parental leave.
• Flexible remote work opportunities.
• Employee referral bonus program.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
