Information System Security Officer (ISSO)

About the role

Everforth ECS is seeking an experienced Information System Security Officer (ISSO) to work in a hybrid capacity at our Fairfax, VA office. The ISSO will support the development, authorization, and ongoing cybersecurity compliance of Jupiter, a newly established DISA IL5 AWS environment supporting CUI. The environment will house multiple U.S. Coalition Mission Partner Environments (MPE). This position is a demanding, high energy role that requires strong cybersecurity judgement, attention to detail, and the ability to help build an RMF authorization package from the ground up across multiple enclaves in a dynamic AWS DoW environment. The ISSO will work closely with the ISSM, cloud and systems engineers, and government cybersecurity team to prepare the environment for an Interim Authorization to Test (IATT) and ultimately an Authorization to Operate (ATO). The ideal candidate has hands-on ISSO experience supporting DoW programs, a strong working knowledge of RMF and NIST 800-53 controls, DISA STIGs, eMASS, ACAS/Nessus, POA&M management, and security authorization documentation. The candidate should be technically capable of independently investigating DTO’s, control artifacts, reviewing system configurations and scan results, and working directly with engineers to validate and remediate cybersecurity findings. Experience supporting AWS DoW environments strongly preferred. The ISSO reports to the Senior Information System Security Manager.

Responsibilities

• Support RMF activities for the AWS IL5 environment throughout system development, IATT, ATO, and continuous monitoring, including security assessments, audit readiness, and authorization package updates.
• Develop and maintain authorization artifacts, including security plans, control implementation evidence, vulnerability documentation, diagrams, inventories, risk documentation, policies, procedures, and SOPs.
• Maintain eMASS records, including control implementation details, artifacts, assessment results, POA&Ms, risk documentation, and continuous monitoring evidence.
• Develop, maintain, and track POA&Ms for vulnerabilities, STIG findings, control deficiencies, assessment findings, and other identified cybersecurity risks.
• Review and validate DISA STIG artifacts and supporting evidence, including checklists, scan results, remediation evidence, mitigations, and closure documentation.
• Perform hands-on