Information System Security Officer (ISSO)

We need to output HTML fragment with sections: Responsibilities, Qualifications (maybe split into Required Qualifications and Desired Qualifications?), Benefits? The posting includes "Total Rewards" and "Compensation" with salary range. According to rules: include Pay section only if posting actually states them. It does: "Posted Salary Range USD $95,500.00 - USD $149,200.00 /Yr." So we need a Pay section. Benefits: there is a "Total Rewards" section describing benefits. So we can include Benefits section. Schedule: not mentioned, so omit. Also need headings: About the role? Not present. Responsibilities: yes. Requirements/Qualifications: we have Required Qualifications and Desired Qualifications. Could combine into Qualifications section with sub-sections? But rule: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have Responsibilities, Qualifications, Benefits, Pay. Possibly also Skills? Not needed. We'll include Responsibilities, Qualifications, Benefits, Pay. We must not repeat job title. No Job ID. Remove boilerplate: EEO, legal, etc. Also remove "Overview" sections? The posting includes Overview Noblis and our wholly owned subsidiaries... and Why Work at Noblis etc. Those are boilerplate? They are not responsibilities/qualifications etc. They are company description; we should remove as per instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Overview" and "Why Work at Noblis" and "Total Rewards" maybe considered boilerplate? But Total Rewards includes benefits description, which we need to keep for Benefits section. However the "Total Rewards" section includes generic benefits description; we can extract substantive info: health, life, disability, financial, retirement benefits, paid leave, professional development, tuition assistance, work-life programs. That's substantive. So we keep Benefits. We need to preserve all substantive information; do not invent or summarize away detail. So we need to list responsibilities as bullet list. The responsibilities paragraph is long; we need to break into bullet points for duties. The instructions: Use

• for any list of duties/requirements/benefits. So we should convert the responsibilities paragraph into a list of duties. Also the "Specific Duties And Responsibilities Include" list already bullet-like. We'll combine. We need to avoid filler like "commensurate with experience". Not present. We need to ensure we don't create sections with only placeholder text. Let's extract responsibilities: From text: "Responsibilities Noblis is hiring an ISSO in Huntsville, AL to supporting the Threat Management Office (TSMO). The mission of the Threat Systems Management Office (TSMO) is to manage the Army Threat System Programs to include the total life cycle of threat systems for testing and training in the live, virtual, and constructive environments. TSMO designs, builds and tests representations of operational and emerging hostile systems with virtually identical performance capabilities that match the identified threat. TSMO ensures all threat systems are continually developed, upgraded, and/or modified and tested to reflect the current threat weapons systems platforms with state-of-the-art technology to support new and emerging DOD weapon systems. Additionally, TSMO conducts threat assessment and analysis in conjunction with the Army, Navy and other joint services operations. TSMO utilizes a combination of simulators and simulation models, foreign material acquisition, commercial-off-the-shelf (COTs), and new development efforts to achieve its goal of providing threat relevant Electronic Warfare (EW), Information Operations (IO), integrated air defense (IADs), and command and control (C2) capabilities to support Operational Test and Evaluation (OT&E) events. These OT&Es include Network Integration Evaluations (NIEs), Combatant Commander events, as well as other testing and training events. TSMO requires a range of activities associated with conceptualizing, developing, and supporting the execution of testing events. Support is required to allow for more realistic threat representation testing for both hardware and/or software, and to upgrade threat systems and sub-systems with modern techniques that will offer superior threat representation testing against foreign threats. The TSMO requires the design of threat representations in order to reproduce live, virtual, and constructive threat simulations that satisfy the U.S. Army Test and Evaluation Command (ATEC) to support future test and training events. In this role, the Information Systems Security Officer (ISSO) leads the Risk Management Framework process for systems assigned, and will support the full lifecycle of the Department of Defense (DoD) RMF process, from system categorization and control implementation through assessment, authorization, and continuous monitoring. The ISSO must possess a strong knowledge of the process for developing Risk Management Framework (RMF) packages from beginning to award of Authority to Operate (ATO) and must also have a thorough understanding of the Enterprise Mission Assurance Support Service (eMASS) system to include inputting data, maintaining records, and navigating the system. The ISSO will support the identification of system vulnerabilities and determine appropriate security controls to mitigate or eliminate risk from the uncovered vulnerabilities. The ISSO will be responsible for preparing artifacts and documents to support government Authorization to Operate (ATO) activities. Additionally, the ISSO will conduct and/or support vulnerability and security compliance assessments using applicable tools, including ACAS/Nessus, SCAP Compliance Checker (SCC), STIG Viewer, and Evaluate-STIG. The Contractor shall analyze assessment results, document security deficiencies, support remediation activities, and maintain evidence necessary to demonstrate compliance with applicable NIST, DoD, DISA, and Army cybersecurity requirements. Specific Duties And Responsibilities Include Serves as an Information Systems Security Officer and will develop and advise on RMF packages, strategies, and technical components to ensure compliance with NIST 800-53 security controls. Assist in the implementation of the required government policy (i.e., NISPOM, NIST, DoD), and documenting process activities.Develop security artifacts to support the Information Assurance program to include System Security Plans (SSP), Plan of Action and Milestones (POA&M), System Diagrams, System User Guides, Privileged User Guides, and other documentation as needed.Perform self-assessments of systems and networks within the environment, using passive evaluation audit tools such as: STIG Viewer, SCAP Compliance Checker (SCC), and active evaluations through ACAS/NESSUS.Track enterprise reporting and efficiencies through automatic generation of required security compliance reports, integration of security tools, system documentation, and other artifacts utilizing the Enterprise Mission Assurance Support Service.Track security updates for Windows and Linux-based operating systems, VMWare based products, and associated software applications to ensure compliance.Periodically conduct a review of system audits, monitor corrective actions until all actions are closed, and identify deficiencies during RMF assessment activities." We need to turn that into bullet list items. Could be many items; we can break into logical duties. Let's create bullet points: - Support the Threat Management Office (TSMO) mission: manage Army Threat System Programs lifecycle for testing/training in live, virtual, constructive environments. - Assist in designing, building, and testing representations of operational and emerging hostile systems matching threat capabilities. - Ensure threat systems are continually developed, upgraded, modified, and tested to reflect current threat weapons platforms with state‑of‑the‑art technology. - Conduct threat assessment and analysis with Army, Navy, and joint services. - Utilize simulators, simulation models, foreign material acquisition, COTS, and new development to provide threat‑relevant EW, IO, IADs, and C2 capabilities for OT&E events (NIEs, Combatant Commander events, etc.). - Support conceptualization, development, and execution of testing events to enable realistic threat representation testing for hardware/software and upgrade threat subsystems with modern techniques. - Design threat representations to reproduce live, virtual, constructive simulations satisfying ATEC for future test/training events. - Lead the Risk Management Framework (RMF) process for assigned systems, supporting full DoD RMF lifecycle from categorization through assessment, authorization, and continuous monitoring. - Develop RMF packages from inception to award of Authority to Operate (ATO); maintain proficiency with eMASS for data input, record keeping, and navigation. - Identify system vulnerabilities and determine appropriate security controls to mitigate or eliminate risk. - Prepare artifacts and documents to support government ATO activities. - Conduct and/or support vulnerability and security compliance assessments using tools such as ACAS/Nessus, SCAP Compliance Checker (SCC), STIG Viewer, Evaluate‑STIG. - Analyze assessment results, document security deficiencies, support remediation, and maintain evidence to demonstrate compliance with NIST, DoD, DISA, and Army cybersecurity requirements. - Serve as ISSO: develop and advise on RMF packages, strategies, and technical components to ensure compliance with NIST 800‑53 controls. - Assist in implementing required government policy (NISPOM, NIST, DoD) and document process activities. - Develop security artifacts for the Information Assurance program: System Security Plans (SSP), Plans of Action and Milestones (POA&M), System Diagrams, System User Guides, Privileged User Guides, and other needed documentation. - Perform self‑assessments of systems and networks using passive evaluation tools (STIG Viewer, SCAP Compliance Checker) and active evaluations via ACAS/Nessus. - Track enterprise reporting and efficiencies through automatic generation of required security compliance reports, integration of security tools, system documentation, and other artifacts via eMASS. - Track security updates for Windows/Linux OS, VMware products, and associated software to ensure compliance. - Periodically review system audits, monitor corrective actions to closure, and identify deficiencies during RMF assessment activities. That seems comprehensive. Now Required Qualifications: list bullet points. From text: - Bachelor's degree in a related field or 7+ years direct experience. - Minimum 5 years of experience in cybersecurity/Information Assurance, with demonstrated RMF/ISSO experience. - Demonstrated experience with DoD RMF and obtaining and maintaining ATOs. - Demonstrated hands‑on experience with eMASS. - Experience conducting vulnerability and STIG/compliance scans using ACAS/Nessus, SCC, STIG Viewer, Evaluate‑STIG, or equivalent tools. - Working knowledge of NIST SP 800‑53 and DoD cybersecurity policies. - DoD 8570/8140‑compliant IAT Level II certification (Security+ CE or higher). - Active DoD Secret clearance with the ability to obtain a Top Secret clearance. - Superior attention to detail and organizational skills. - Excellent communications skills. - US Citizenship. - Strong analytical and problem‑solving skills. Desired Qualifications: - Prior official assignment as an ISSO or ISSM. - Prior experience serving as an ISSO supporting DoD or Army systems. - Top Secret/SCI security clearance. - Experience supporting classified and/or multi‑level security environments. - Experience with Windows, Linux, VMware, and system security/hardening. - Desired Certifications: CISSP, SecurityX / CASP+, CySA+, or other applicable cybersecurity certifications. We could combine Required and Desired into one Qualifications section with subheadings? But rule only allows headings from list; we could have Qualifications heading and then separate sub-sections? Not allowed to create extra headings beyond those list? It says use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but better to stick to those. We could have Qualifications and then within that we can have

  with required and desired separated maybe via
  • with bold? But we need to preserve all detail. Could split into two subsections using

    ? Not in list; maybe not allowed. Safer to have two sections: Requirements and Qualifications? The list includes Requirements and Qualifications as separate possible