The Role
Support federal information systems security authorization and continuous monitoring across the FISMA and RMF lifecycle. Responsibilities include managing A&A and ATO activities, POA&Ms, vulnerability remediation, SSPs, risk assessments, security audits, asset inventories, change reviews, incident support, encryption compliance, and ongoing authorization reporting. The role requires close coordination with government stakeholders and security teams while ensuring compliance with DHS, NIST, FISMA, and related cybersecurity requirements.
Summary Generated by Built In
OverviewAMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs through our strategic solutions in the areas of Information Technology, Test & Evaluation, Program Mission Support, Engineering & Analysis, and Training. We are seeking an Information System Security Officer (ISSO) to support a Network Operations Center Network Management Support Services. The ISSO will serve as a designated security professional for one or more FISMA systems of record and new information systems, supporting the Assessment and Authorization (A&A) lifecycle, Authority to Operate (ATO) activities, ongoing authorization, continuous monitoring, vulnerability management, and compliance with government security requirements. This role will work closely with the Government Program Manager, Technical POC/Task Manager, Information Systems Security Manager (ISSM), COR, system owners, engineers, and security stakeholders.
Responsibilities
- Perform ISSO duties in accordance with DHS 4300A, HB 1400-05D, FISMA guidance, applicable NIST publications, and approved program SOPs.
- Lead or support the Assessment and Authorization (A&A), reaccreditation, and continuous-monitoring processes for assigned information systems.
- Notify security leadership of upcoming accreditation or reaccreditation requirements and coordinate reaccreditation kickoff activities with the agency's Security Authorization Team.
- Support the transition of designated systems to Ongoing Authorization (OA), also known as continuous monitoring.
- Manage Plans of Action and Milestones (POA&Ms), including development, documentation, SME follow-up, remediation tracking, and status reporting.
- Review Information Security Vulnerability Management (ISVM) messages, determine applicability, acknowledge notifications, track remediation, and coordinate POA&M creation for unresolved vulnerabilities.
- Review weekly network scans and log information; prepare vulnerability summaries and identify critical and high-risk issues affecting assigned systems.
- Maintain accurate system asset inventories and provide updates to the Vulnerability Assessment Team (VAT); reconcile system inventories with DHS detailed asset reports.
- Review proposed change requests to verify that changes comply with security standards and update asset records and System Security Plans (SSPs) when systems or configurations change.
- Develop, review, maintain, and submit A&A and security documentation for Government approval, including SSPs, risk assessments, FIPS 199 categorization assessments, ST&E plans and results, ATO and ATT artifacts, contingency plans, ISAs, waivers, and POA&Ms.
- Review and update SSPs annually or when significant system changes occur; complete annual NIST SP 800-26 or NIST SP 800-53 assessments as required.
- Prepare documentation and support the annual Ongoing Authorization Review Management Board (OARMB), DHS/CISA/OMB audits, cybersecurity data calls, and FedRAMP or cloud-as-a-service activities, as applicable.
- Assist the Computer Security Incident Response Center (CSIRC) with investigations of security violations and incidents.
- Support encryption and security compliance requirements, including FIPS 197 AES-256, FIPS 140-2 validated cryptographic modules, NSA Type 1 or
- Type 2 encryption, PKI, and emerging FIPS 203, 204, and 205 requirements.
- Prepare weekly ISSO reports covering ATO activities, assessments, audits, change requests, POA&Ms, ISVMs, waivers, compliance highlights, and issues requiring management guidance.
- Senior ISSO candidates should demonstrate approximately 5–10 years of relevant information systems security, cybersecurity, or security authorization experience. Candidates supporting junior-level ISSO assignments.
- In-depth knowledge of the Risk Management Framework (RMF), NIST publications, FISMA, DHS 4300A, and HB 1400-05D.
- Assessment and Authorization: Demonstrated experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities.
- Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms in an enterprise environment.
- Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation.
- Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes.
- Ability to work effectively in a team environment, build rapport with Government and customer organizations, and communicate technical security issues clearly.
- Education: Bachelor’s degree in cybersecurity, information assurance, computer science, information systems, or a related field is preferred; equivalent relevant experience may be considered.
- Experience supporting a federal or other mission-critical enterprise network operations environment.
- Ability to obtain Public Trust, Preferred Secret/Top Secret Clearance
- CISSP, Security+, Network+, CISA, CAP, or security auditing certification recommended.
Skills Required
- Approximately 5-10 years of relevant information systems security, cybersecurity, or security authorization experience
- In-depth knowledge of the Risk Management Framework, NIST publications, FISMA, DHS 4300A, and HB 1400-05D
- Experience implementing or assessing NIST SP 800-53 controls and supporting A&A, ATO, reaccreditation, or continuous-monitoring activities
- Experience reviewing Nessus or comparable vulnerability scans, tracking ISVMs, managing remediation, and developing or maintaining POA&Ms
- Experience preparing or maintaining SSPs, security assessments, risk assessments, contingency plans, ST&E artifacts, ATO packages, waivers, and related security documentation
- Understanding of enterprise networking concepts, infrastructure, architectures, and configuration changes
- Ability to work effectively in a team environment and communicate technical security issues clearly
- Bachelor's degree in cybersecurity, information assurance, computer science, information systems, or a related field
- Experience supporting a federal or mission-critical enterprise network operations environment
- Ability to obtain Public Trust
- Secret or Top Secret clearance
- CISSP, Security+, Network+, CISA, CAP, or security auditing certification
AMERICAN SYSTEMS Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about AMERICAN SYSTEMS and has not been reviewed or approved by AMERICAN SYSTEMS.
-
Equity Value & Accessibility — The ESOP provides an ownership stake that adds long-term financial value and complements base pay. This employee-ownership structure stands out within the overall package.
-
Retirement Support — A 401(k) with automatic enrollment and broad investment options, alongside the ESOP, strengthens retirement pathways beyond salary. These features are presented as competitive within the defense contracting space.
-
Fair & Transparent Compensation — Base pay is considered fair or comparable to industry peers, particularly for technical roles. Starting compensation is described as solid for areas like cybersecurity, systems administration, and IT engineering.
AMERICAN SYSTEMS Insights
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
AMERICAN SYSTEMS is an employee-owned government services contractor that delivers professional, technical, information technology, engineering, analysis, testing, evaluation, and training solutions for complex national-priority programs. Based in McLean, Virginia, the company supports federal customers—particularly defense and other Department of Defense missions—with mission-essential and information engineering, digital engineering, systems integration, cybersecurity, cloud, data, and lifecycle IT services across critical public-sector environments.
