The Role
Supports USAF systems by developing and maintaining ATO and Assess-Only authorization packages, SSPs, POA&Ms, and RMF documentation in eMASS. Performs continuous monitoring, STIG compliance, vulnerability management, remediation tracking, configuration impact assessments, and cATO support. Coordinates with system owners, engineers, assessors, ISSMs, and government stakeholders; maintains security records, supports audits and incident response, and provides risk information and compliance briefings.
Summary Generated by Built In
cFocus Software seeks a Information System Security Officer (ISSO) to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.
Qualifications:
Qualifications:
- Active TS/SCI clearance
- B.S. Computer Science, Information Technology, or a related field
- Experience performing ISSO duties and developing or maintaining RMF authorization packages.
- Experience preparing SSPs, assessment documentation, control evidence, and POA&Ms in eMASS.
- Knowledge of security control assessment, continuous monitoring, STIG compliance, and vulnerability management.
- Ability to evaluate security findings, coordinate remediation, and maintain accurate system risk records.
- Understanding of authorization boundaries, configuration control, and security impacts of system changes.
- Ability to work with system owners, ISSMs, engineers, assessors, and Government stakeholders.
- Strong technical writing, evidence management, and communication skills for reviews and reporting
- Develop, maintain, and update Authorization to Operate (ATO) and Assess-Only Authorization packages for assigned DC3 systems.
- Execute steady-state RMF activities for systems with valid authorizations, including ongoing security control assessments, STIG compliance, and remediation tracking.
- Prepare initial System Security Plans (SSPs), support execution of Security Assessment Plans, and assemble authorization evidence for systems lacking an ATO.
- Maintain complete, current system records in the Enterprise Mission Assurance Support Service (eMASS); resolve documentation and evidence gaps with technical teams.
- Maintain system-level Plans of Action and Milestones (POA&Ms), track corrective actions and dependencies, and provide updates for enterprise consolidation by the ISSM.
- Review vulnerability assessment and configuration compliance results; coordinate remediation, validate closure evidence, and identify overdue or unresolved findings.
- Support continuous ATO (cATO) through automated compliance evidence and monitoring data in coordination with DevSecOps and operations personnel.
- Assess assigned system changes for security and authorization impacts; maintain consistent boundaries, configurations, inventories, and supporting records.
- Track applicable cyber orders, taskers, and directives; coordinate required system changes and prepare compliance documentation or POA&Ms when immediate compliance is not achievable.
- Provide the ISSM with system risk information, remediation options, and supporting evidence for enterprise risk analysis and Government risk acceptance decisions.
- Coordinate with system owners, assessors, engineers, and the ISSM to prepare packages for Government review and address review findings before planned deployment.
- Support incident response by providing system security documentation, assessing control implications, and tracking directed corrective actions.
- Maintain security procedures and assessment records; support audits and provide status briefings, compliance evidence, and technical documentation as assigned.
Skills Required
- Active TS/SCI security clearance
- Bachelor of Science degree in Computer Science, Information Technology, or a related field
- Experience performing ISSO duties
- Experience developing or maintaining RMF authorization packages
- Experience preparing SSPs, assessment documentation, control evidence, and POA&Ms in eMASS
- Knowledge of security control assessment, continuous monitoring, STIG compliance, and vulnerability management
- Ability to evaluate security findings, coordinate remediation, and maintain system risk records
- Understanding of authorization boundaries, configuration control, and security impacts of system changes
- Ability to collaborate with system owners, ISSMs, engineers, assessors, and government stakeholders
- Strong technical writing, evidence management, and communication skills
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 2006, cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint. cFocus Software is the exclusive vendor of ATO (Authority To Operate) as a Service™, which automates FedRAMP compliance for the Azure Government Cloud and Office 365. Contact Us for a demo of ATO as a Service™ or a FREE government chatbot proof of concept project today!
