Information System Security Officer (ISSO)

Job Description:

NDi is seeking an experienced Information System Security Officer (ISSO) to provide cybersecurity, Risk Management Framework (RMF), and system authorization support for a large, mission-critical federal enterprise communications environment.

The ISSO supports multiple information systems and authorization packages associated with enterprise voice and unified communications services, including Microsoft Teams-based telephony, EVoIP, legacy Avaya capabilities, and supporting infrastructure. The role works closely with System Owners, system engineers and administrators, Information System Security Managers (ISSMs), Authorizing Officials (AOs), and other cybersecurity stakeholders to maintain the security posture and authorization status of assigned systems. Current program activity indicates the ISSO supports artifacts associated with approximately seven to eight systems/authorization efforts, rather than a single ATO.

The position is responsible for supporting the full security authorization lifecycle, including security control implementation and validation, artifact collection, ATO package development and maintenance, vulnerability remediation, POA&M management, continuous monitoring, security assessments, and compliance activities.

Requirements:

• U.S. Citizenship is required
• Must possess an active TS clearance at the time of application, be willing and able to obtain SCI access, and pass a CI polygraph.
• This position is onsite 5/days a week in Huntsville, Alabama
• Occasional Travel may be required

Qualifications and Experience:

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Information Technology, or a related discipline, or an equivalent combination of education, training, and relevant experience
• Minimum of 5 years of related cybersecurity, information assurance, RMF, or system security experience.
• Experience supporting federal RMF and ATO processes.
• Experience developing and maintaining system security documentation and authorization artifacts.
• Experience with vulnerability identification, remediation tracking, and Plan of Action and
• Milestones (POA&M) management.
• Understanding of security controls, continuous monitoring, risk management, and security assessment activities.
• Strong technical documentation, communication, and organizational skills.

Preferred Qualification & Skills:

• Experience supporting FBI, DOJ, DoD, Intelligence Community, or other federal information systems.
• Experience with Xacta/Xacta 360, JCAM, Tenable Nessus, Splunk, or comparable GRC, vulnerability-management, and SIEM tools.
• Experience supporting multiple systems or authorization packages concurrently.
• Familiarity with Microsoft enterprise environments, including Microsoft 365 and Microsoft Teams.
• Experience supporting enterprise unified communications, VoIP/EVoIP, Avaya, SIP, or related communications infrastructure.
• Relevant cybersecurity certifications such as Security , CISSP, CAP/CGRC, or similar credentials.

Technical Skills:

• Experience with Xacta/Xacta 360, JCAM, Tenable Nessus, Splunk, or comparable GRC, vulnerability-management, and SIEM tools.
• Experience supporting multiple systems or authorization packages concurrently.
• Familiarity with Microsoft enterprise environments, including Microsoft 365 and Microsoft Teams.
• Experience supporting enterprise unified communications, VoIP/EVoIP, Avaya, SIP, or related communications infrastructure.

Key Responsibilities:

• Serve as an ISSO supporting multiple enterprise information systems and security authorization activities.
• Support systems throughout the RMF and ATO lifecycle, including authorization, system changes, continuous monitoring, and reauthorization.
• Develop, review, and maintain security documentation, including:
• System Security Plans (SSPs)
• POA&Ms
• Risk assessments
• Contingency plans
• Security control implementation documentation
• Assessment evidence and authorization artifacts
• Coordinate the collection and validation of evidence supporting implementation of required security controls.
• Work with system owners, engineers, administrators, and cybersecurity stakeholders to address security and compliance requirements.
• Review vulnerability and security assessment findings and coordinate remediation or mitigation activities with technical teams.
• Develop, maintain, and track POA&Ms through remediation and closure.
• Support vulnerability scanning, security assessments, audits, compliance reviews, and continuous monitoring activities.
• Review planned system, infrastructure, and configuration changes for potential cybersecurity and authorization impacts.
• Assist technical teams in translating security requirements and vulnerability findings into actionable remediation activities.
• Maintain security documentation so that it accurately reflects the system architecture, configuration, operating environment, and security posture.
• Provide cybersecurity status, risk, compliance, and remediation information to program and
• Government stakeholders.
• Support secure operation and modernization of enterprise communications and IT infrastructure.