> Markdown version of [/jobs/ext/3452799-information-system-security-officer-isso](https://www.wearedevelopers.com/jobs/ext/3452799-information-system-security-officer-isso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information System Security Officer (ISSO) - **Company:** Jfl Consulting, Llc - **Location:** Bellevue, NE, United States - **Experience:** Expert - **Salary:** $120,000.0 - $140,000.0 - **Contract:** Permanent contract - **Skills:** Xacta, Systems Engineering, Cloud Computing Security, CompTIA Security+, Cyber Security, Information Systems, Information Security Management, Comptia Pentest+ CE, Security Content Automation Protocol, Software Deployment, Software Vulnerability Management, Information Technology, Nessus, Vulnerability Analysis - **Published:** September 30, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9200237/information-system-security-officer-isso ## About the Role * Required Baseline Certification: Active CompTIA Security+ CE certification is required as a minimum DoD 8140 baseline unless superseded by one or more of the advanced credentials below. * Preferred / Qualifying Advanced Certifications: Holding any of the following satisfies the baseline requirement and is preferred to align with intermediate DoD Cyber Workforce Framework Role 722 (ISSM) or Role 612 (Security Control Assessor) responsibilities: + CISSP, CISM, CISA, or CGRC + CCSP or Cloud+ + SecurityX (CASP+), CySA+, or PenTest+ Experience: * 3-8+ years of information security, cybersecurity, or information technology experience. * Hands-on experience supporting Department of Defense Risk Management Framework (RMF) processes and system authorization activities. * Experience with vulnerability management, security scanning, STIG implementation, and remediation. * Working knowledge of cybersecurity principles, security controls, and DoD compliance requirements. * Experience supporting system authorization, reauthorization, and continuous monitoring activities. Technical Skills: * Working knowledge of NIST SP 800-53, NIST Risk Management Framework (RMF), Security Technical Implementation Guides (STIGs), Continuous Monitoring (ConMon), eMASS or similar compliance tools, Security Control Assessments (SCAs), and Authorization to Operate (ATO) packages. * Understanding of cybersecurity risk management, security control validation, and compliance requirements. * Familiarity with vulnerability assessment and remediation processes. * Familiarity with incident response processes and corrective actions. Communication: * Strong written and verbal communication skills. * Ability to develop and maintain clear technical and cybersecurity documentation. * Ability to communicate security risks and compliance requirements to both technical and non-technical stakeholders. * Ability to coordinate effectively across engineering, operations, cybersecurity, and program teams. Preferred Education, Experience, & Skills: * Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent relevant experience. * Experience supporting federal government or Department of Defense information systems. * Experience supporting multiple RMF packages and ATO efforts. * Experience with eMASS, Xacta, and DoD authorization processes. * Familiarity with cloud security technologies and architectures. * Demonstrated experience with cybersecurity risk management, RMF implementation, ATO support, vulnerability remediation, STIG compliance, audit/SCA support, incident response, security documentation, security control validation, and continuous monitoring. ## Description Job Overview: JFL Consulting is seeking a skilled Information System Security Officer (ISSO) to support cybersecurity, Risk Management Framework (RMF), and system authorization activities across secure government environments. This position is focused on maintaining the security posture of assigned information systems throughout their lifecycle, supporting Authorization to Operate (ATO) and continuous monitoring activities, and ensuring compliance with applicable DoD cybersecurity requirements. Candidates should have hands-on experience with RMF processes, security documentation, vulnerability management, security control implementation and validation, and remediation activities., * Work directly with the Risk Management Framework (RMF) team (e.g., Information System Security Managers (ISSM), ISSOs, Cyber Security Engineers) supporting critical networks, and future RMF/Authorization to Operate (ATO) efforts. * Maintain the security posture of assigned information systems throughout their lifecycle. * Support RMF activities, including system authorization and reauthorization efforts. * Support development, maintenance, and execution of RMF packages within eMASS, Xacta, or other applicable compliance tools. * Ensure compliance with applicable cybersecurity policies, standards, and frameworks, including NIST guidance (Special Publication (SP) 800-53 Rev. 5) and Department of Defense cybersecurity requirements. * Support Security Control Assessments (SCAs), audits, inspections, and authorization activities. * Coordinate security control remediation efforts with ISSMs, Network / Systems Engineers, System Administrators and support maintenance of system authorization status. Security Documentation & Compliance * Develop, maintain, and review system security documentation, including: * System Security Plans (SSPs) * Plans of Action and Milestones (POA&Ms) * Security Control Traceability Matrices (SCTMs) * Review security configurations, system changes, and software deployments for cybersecurity and compliance impacts. * Track and report cybersecurity metrics, vulnerabilities, incidents, remediation activities, and overall compliance status. * Support continuous monitoring (ConMon) activities and associated documentation. * Maintain accurate documentation necessary to support RMF, ATO, audit, and compliance requirements. Vulnerability Management & Security Operations * Monitor system vulnerabilities and ensure timely mitigation, remediation, and documentation. * Support vulnerability assessments, security scanning, Security Technical Implementation Guide (STIG) implementation, and remediation activities using tools such as Nessus Pro, Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP), and EvaluateSTIG. * Assist with incident response activities, investigations, and corrective actions. * Validate security controls and system configurations to ensure continued compliance with established cybersecurity requirements. * Identify cybersecurity risks and coordinate appropriate remediation with technical and program stakeholders. Technical Coordination & Communication * Coordinate with system owners, engineers, administrators, cybersecurity personnel, and other stakeholders to address security and compliance requirements. * Communicate cybersecurity risks, vulnerabilities, compliance issues, and remediation requirements to technical (ISSM) and program leadership. * Manage multiple systems, priorities, and authorization activities simultaneously. * Produce clear and accurate technical documentation, reports, and cybersecurity status updates. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [Outsmarting the System: What Game Cheaters Can Teach Us About Cyber Security](https://www.wearedevelopers.com/videos/1396-outsmarting-the-system-what-game-cheaters-can-teach-us-about-cyber-security) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)