Information Systems Security Officer (ISSO

The Information Systems Security Officer (ISSO) is responsible for the security, compliance, and operational integrity of MSI Defense Solutions’ information systems supporting both classified and unclassified environments. The ISSO serves as the primary cybersecurity and information assurance lead, ensuring systems comply with DoD Risk Management Framework (RMF), NIST SP 800-171, NIST SP 800-53, CMMC, and other applicable federal security requirements.

This position is responsible for maintaining Authorization to Operate (ATO) packages, supporting security assessments, implementing continuous monitoring activities, and safeguarding Controlled Unclassified Information (CUI) and classified information. The ISSO partners closely with Information Technology, Security, Engineering, Program Management, and government customers to ensure cybersecurity requirements are integrated throughout the system lifecycle.

The ISSO will report to the Digital Technology Manager. The position requires a full-time work week spent in the office or hybrid with 3 days onsite. Normal hours are Monday through Thursday 7:00am-4:30pm and Friday 7:00am - 12:00pm. (Must be flexible to work additional hours as needed based on project requirements and deadlines.), * Serve as the Information Systems Security Officer (ISSO) for classified and unclassified information systems.

• Maintain compliance with the DoD Risk Management Framework (RMF), NIST SP 800-53, NIST SP 800-171, CMMC, and applicable DoD cybersecurity policies.
• Develop, maintain, and update System Security Plans (SSPs), POA&Ms, Security Assessment Reports (SARs), and RMF documentation.
• Administer and maintain the organization’s Governance, Risk, and Compliance (GRC) platform (e.g., IntelliGRC), ensuring security documentation, evidence, POA&Ms, and assessment artifacts remain current and audit ready.
• Support Authorization to Operate (ATO), Authority to Connect (ATC), and continuous monitoring activities.
• Ensure implementation and maintenance of required security controls across enterprise systems.
• Conduct vulnerability assessments, security audits, and remediation tracking.
• Coordinate vulnerability scanning, patch management, and secure system configuration.
• Investigate, document, and coordinate cybersecurity incident response activities.
• Administer user access controls and privileged account management in accordance with least privilege principles.
• Ensure compliance with security requirements for classified systems and secure facilities.
• Lead the preparation for internal audits, DCSA assessments, customer inspections, and CMMC assessments including evidence collection, artifact management, and assessor coordination.
• Collaborate with IT, Engineering, and Program teams to integrate cybersecurity throughout project execution.
• Develop and maintain cybersecurity policies, procedures, and user awareness initiatives.
• Support secure implementation of Microsoft 365 GCC High, Azure, Microsoft Defender, Intune, and related security technologies.
• Serve as the primary cybersecurity liaison for government customers and external auditors.
• Monitor compliance status, track remediation activities, and provide regular reporting on cybersecurity posture and outstanding compliance actions to leadership.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).
• 5+ years of cybersecurity, information assurance, or information systems security experience within a DoD or federal contractor environment.

• Strong knowledge of: *

• DoD Risk Management Framework (RMF)
• NIST SP 800-53
• NIST SP 800-171
• CMMC Level 2
• STIG implementation
• Experience managing Authorization to Operate (ATO) packages.
• Experience supporting classified information systems.
• Experience administering Microsoft 365 GCC High, Azure Active Directory, Microsoft Defender, Intune, and endpoint security solutions.
• Experience conducting vulnerability management and remediation.
• Familiarity with SIEM solutions and continuous monitoring tools.
• Excellent documentation and technical writing skills.
• Strong communication and collaboration skills.

Preferred Qualifications

• Experience supporting CMMC Level 2 environments or similar regulated environments
• Familiarity with tools such as Microsoft Defender, SIEM platforms, and compliance tools (e.g., IntelliGRC)
• Relevant certifications (Security+, CySA+, CISSP, or similar)
• Experience with audit preparation and evidence collection

Security Requirements

• S. Citizenship is required.
• An active Secret security clearance is required.
• Must be able to maintain eligibility for access to classified information.

Physical Requirements

• Prolonged periods sitting at a desk and working on a computer
• Must be able to lift up to 30 pounds at times.
• Must be able to access and navigate each department at the organization’s facilities.

Paid parental leave, Parental leave, Health insurance, 401(k) matching, Paid time off, Vision insurance, Dental insurance, Life insurance, * 401(k) with employer match

• Dental Insurance
• Disability Insurance
• Health Insurance
• Vision Insurance
• Paid Parental and Maternity Leave
• Life Insurance
• Paid Time Off - 120 hours per year to start (prorated in first year of employment)
• Continuing Education
• Annual Year End Paid Holiday Closure

Every employee at MSI is expected to operate in accordance with the MSI Operating Code. These seven principles define how we think, decide, and execute. They are not aspirational. They are the working standard by which all employees are evaluated.

The Seven Principles

• Own It. If a problem touches your function, it is yours until it is solved or explicitly transferred. Do not wait. Do not delegate upward. Do not hide behind process. Ownership means driving to resolution, not monitoring status.
• Kill the Wrong Fight. Before optimizing a solution, question whether the problem is yours to solve. If an opportunity requires MSI to become something we are not, kill it fast. The discipline to say no is what protects our ability to say yes to the right things.
• Move Before You’re Told. Speed is MSI’s compounding advantage. We move when directionally correct and adjust in motion. Leaders who wait for permission are not leading. We would rather correct a fast decision than wait for a perfect one.
• Solve Before You Contract. Prove the integration works before formalizing the relationship. Capability first, paperwork follows. Working capability is the strongest negotiating position and the most honest form of business development.
• Integrate First. MSI’s moat is not any single technology. It is the ability to integrate modular systems faster and more effectively than anyone else. Every decision should reinforce our position as the integration hub.
• Say It Now. Silence is not alignment. If you disagree, say so, with data, with reasoning, and with an alternative path. Passive execution is institutional risk.
• Build Beyond Yourself. If your function depends on your presence to operate, you have not built anything. Develop your people. Document your processes. Create depth that survives your absence.