Information Systems Security Officer (ISSO) II

Job Summary:

The Information Systems Security Officer II (ISSO II) is responsible for supporting the security and compliance of assigned information systems and networks in accordance with applicable government, customer, and organizational requirements. With at least three years of relevant experience, the ISSO performs recurring security activities with limited supervision, maintains System Security Plans and related authorization documentation, evaluates security controls, conducts vulnerability and continuous monitoring activities, and supports incident response and remediation. The position works directly with program managers, system administrators, security engineers, and internal and external customers throughout the system life cycle. The ISSO also implements procedures for the protection, handling, and accountability of classified systems, media, and equipment and evaluates system changes for security and documentation impacts.

Requirements:

• Performs information system security activities with limited supervision and applies established requirements and professional judgment to routine and moderately complex assignments.?
• Prepares, maintains, and updates System Security Plans, security control documentation, risk assessments, Plans of Action and Milestones, and other authorization artifacts.?
• Coordinates system authorization and continuous monitoring activities, including evidence collection, control reviews, documentation updates, and status reporting.?
• Conducts vulnerability scans, analyzes results, documents findings, recommends corrective actions, and tracks remediation through validation and closure.?
• Monitors assigned systems for compliance with approved security configurations, access requirements, operating procedures, and authorization conditions.?
• Reviews proposed hardware, software, configuration, account, and network changes; evaluates security impact; and ensures required approvals and documentation are completed.?
• Conducts recurring user account, access authorization, security training, audit log, media, and configuration reviews and documents results.?
• Identifies, documents, reports, and supports the investigation and mitigation of suspected security incidents in accordance with established procedures.?
• Implements and maintains procedures for the protection, control, storage, transfer, and disposition of classified systems, media, and equipment.?
• Advises technical staff and program personnel on established security requirements, identified risks, documentation needs, and corrective actions.?
• Coordinates with internal and external stakeholders to resolve security findings, obtain required evidence, and maintain authorization schedules.?
• Maintains accurate security records and provides clear status reports on risks, findings, remediation activities, and assigned deliverables.?
• Researches applicable cybersecurity requirements and recommends updates to procedures, documentation, or security practices.?
• Escalates significant risks, incidents, unresolved findings, and matters requiring management or senior security review.?
• Knowledge of cybersecurity principles, including confidentiality, integrity, availability, least privilege, defense in depth, and risk management.?
• Working knowledge of information system security controls, authorization documentation, continuous monitoring, vulnerability management, configuration management, and incident response.?
• Working knowledge of government and cybersecurity and classified information system requirements applicable to the assigned environment.?
• Knowledge of Windows and/or Linux operating systems, networks, user account administration, security configurations, audit logs, and common security technologies.?
• Skill in preparing and maintaining System Security Plans, control narratives, risk assessments, Plans of Action and Milestones, reports, and supporting evidence.?
• Skill in operating vulnerability scanning, endpoint security, log review, ticketing, collaboration, and standard office productivity tools.?
• Skill in analyzing security findings, identifying potential risk, determining appropriate next steps, and tracking corrective actions.?
• Ability to interpret and apply security policies, technical guidance, standard operating procedures, contract requirements, and customer direction.?
• Ability to independently manage recurring security activities and moderately complex assignments while recognizing matters requiring escalation.?
• Ability to communicate technical, risk, and compliance information clearly in writing and verbally to technical and nontechnical audiences.?
• Ability to coordinate across functional teams, manage competing priorities, meet deadlines, and maintain accurate and complete records.?
• Ability to protect sensitive and classified information and exercise sound judgment, discretion, and professional integrity.?

Qualifications:

• Minimum of three years of relevant experience in information system security, cybersecurity, information technology, system administration, network administration, security compliance, or a related field.?
• Bachelor's degree in cybersecurity, information technology, computer science, management information systems, or a related field; equivalent relevant education, training, certifications, and experience may be considered.?
• Ability to obtain and maintain the security clearance and customer access required for the position.?
• Baseline cybersecurity certification meeting contract or customer requirements is preferred or may be required within a specified period after hire.?
• Demonstrated experience with security documentation, vulnerability management, system administration, networking, security controls, or compliance activities