Position Summary: The Information Systems Security Officer (ISSO) is responsible for supporting the security, compliance, and ongoing authorization of organizational information systems, with particular emphasis on systems that process, store, or transmit Controlled Unclassified Information (CUI) and other sensitive information. This role works closely with IT, System Owners, Business Stakeholders, leadership and third-party security partners to implement and maintain security controls, monitor system security, manage compliance documentation, identify and remediate vulnerabilities and support cybersecurity assessments and audits. This position plays a key role in maintaining compliance with applicable cybersecurity requirements including CMMC Level 2, NIST SP 800-171, DFARS requirements and organizational security policies and procedures.
Key Responsibilities:
Security & Compliance Management – Maintain compliance with applicable cybersecurity requirements, including CMMC Level 2, NIST SP 800-171, DFARS, ITAR, PCI DSS, and company security policies.
Security Control Oversight – Ensure required security controls are implemented, operating effectively, documented, and periodically reviewed.
CMMC & Audit Readiness – Maintain continuous readiness for C3PAO and other cybersecurity assessments, including coordinating evidence collection, control validation, and remediation. SPRS score maintenance and subcontractor flow-down compliance.
Security Documentation – Maintain the System Security Plan (SSP), POA&Ms, policies, procedures, risk assessments, control evidence, and other required compliance documentation.
Vulnerability & Risk Management – Identify, assess, track, and coordinate remediation of vulnerabilities, security deficiencies, and compliance gaps. Experience with Tenable.IO vulnerability management preferred.
Daily hands-on SIEM/XDR review
Access & System Security – Review access controls, privileged accounts, system configurations, security baselines, logging, encryption, and other protections for sensitive systems and CUI.
Security Monitoring & Incident Response – Actively monitor security events and alerts and Coordinate with IT and security/SOC providers to monitor security events, investigate incidents, document findings, and work directly with IT and security/SOC providers through appropriate remediation.
Technology & Vendor Security Reviews – Evaluate new applications, SaaS platforms, AI tools, hardware, vendors, and system changes for cybersecurity and compliance risks.
CUI Protection & Scope Management – Help maintain the security boundary for systems that store, process, or transmit CUI and ensure appropriate handling and protection requirements are followed.
Policy & Security Awareness/Tracking/Reporting – Develop and maintain cybersecurity policies, standards, procedures, and security-awareness requirements. Tracking and reporting on Security Awareness metrics.
Cross-Functional Coordination – Work with IT, Legal, Contracts, business owners, leadership, vendors, consultants, and assessors to address cybersecurity and compliance requirements.
Continuous Improvement – Monitor changes in cybersecurity requirements and threats and recommend improvements to strengthen the organization's overall security posture.
Other duties as assigned
Required Qualifications
Bachelor’s degree in Cybersecurity, Information Technology, Information Systems, Computer Science, or a related field; equivalent relevant experience may be considered in lieu of a degree.
3+ years of experience in cybersecurity, information security, IT security, systems administration, IT compliance, or a related technical field.
Working knowledge of cybersecurity frameworks and requirements, particularly NIST SP 800-171 and CMMC Level 2.
Hands-on experience working in a DoD/DoW contractor or subcontractor environment.
Experience with Tenable.io, Microsoft Sentinel, and Microsoft Defender for Endpoint (or comparable SIEM/XDR/vulnerability management…