Information Systems Security Officer (ISSO) Junior

The Junior ISSO will assist with implementing and monitoring cybersecurity controls, maintaining security documentation, supporting Risk Management Framework (RMF) activities, tracking vulnerabilities and POA&Ms, and ensuring systems remain compliant with applicable federal cybersecurity requirements., * Assist with day-to-day security activities for assigned information systems and applications.

• Support implementation and monitoring of cybersecurity controls.
• Assist with NIST Risk Management Framework (RMF) activities throughout the system lifecycle.
• Maintain and update System Security Plans (SSPs) and other security authorization documentation.
• Collect, organize, and maintain evidence supporting security control implementation.
• Assist with preparation and maintenance of Authorization to Operate (ATO) packages.
• Monitor security controls and identify potential compliance gaps or weaknesses.
• Track vulnerabilities, security findings, and Plans of Action and Milestones (POA&Ms).
• Coordinate with system owners, system administrators, engineers, and cybersecurity personnel to support remediation activities.
• Assist with validating remediation of security findings and vulnerabilities.
• Support continuous monitoring activities and periodic security control reviews.
• Assist with security control assessments and provide requested documentation and evidence to Security Control Assessors (SCAs).
• Review vulnerability scan results and assist with tracking remediation.
• Monitor system changes and identify potential security impacts.
• Assist with configuration, security baseline, and compliance reviews.
• Support cybersecurity audits, inspections, and compliance assessments.
• Maintain accurate security records, documentation, and assessment artifacts.
• Assist with security incident reporting and coordination as required.
• Prepare status reports, cybersecurity metrics, and management updates.
• Stay current on applicable federal cybersecurity policies, standards, and best practices.

• Bachelor’s degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related field.
• Experience or academic background in cybersecurity, information assurance, information security, or IT security.
• Working knowledge of cybersecurity concepts, security controls, and risk management.
• Familiarity with the NIST Risk Management Framework (RMF).
• Understanding of basic cybersecurity compliance and security assessment concepts.
• Ability to review technical documentation and maintain accurate security records.
• Strong analytical, organizational, written, and verbal communication skills.
• Ability to work effectively with technical teams, system owners, and cybersecurity professionals.
• Ability to manage multiple tasks and meet deadlines in a mission-focused environment.

Preferred Certification

One or more of the following is preferred:

• CompTIA Security+
• Systems Security Certified Practitioner (SSCP)
• Certified Authorization Professional (CAP)
• Certified Information Systems Security Professional (CISSP)
• Other recognized cybersecurity or information assurance certification, * Experience supporting federal civilian or Department of Defense (DoD) cybersecurity programs.
• Experience with NIST SP 800-53 and NIST SP 800-37.
• Familiarity with FISMA requirements.
• Experience supporting RMF documentation and ATO activities.
• Familiarity with System Security Plans (SSPs), Security Assessment Reports (SARs), and POA&Ms.
• Experience supporting continuous monitoring activities.
• Familiarity with eMASS, RSA Archer, ServiceNow GRC, or similar GRC platforms.
• Experience with vulnerability management and security assessment tools.
• Exposure to cloud security environments such as AWS, Azure, Google Cloud, or Microsoft 365.
• Familiarity with security control implementation and assessment processes.

Technical Skills

• Information System Security
• ISSO Support
• NIST RMF
• NIST SP 800-53
• NIST SP 800-37
• FISMA
• Security Controls
• Security Compliance
• ATO / Authorization
• Continuous Monitoring
• System Security Plans (SSPs)
• Security Assessment Reports (SARs)
• POA&M Management
• Vulnerability Management
• Security Control Assessment
• Risk Management
• Cybersecurity Documentation
• GRC Platforms
• eMASS
• RSA Archer
• ServiceNow GRC