Information System Security Officer (ISSO)
About the role
Noblis and our wholly owned subsidiaries, Noblis ESI and Noblis MSD, take on some of the nation's toughest challenges, delivering advanced solutions to our customers' most critical missions. We bring together leading scientific, engineering, and management expertise in a culture grounded in objectivity and collaboration, ensuring our work creates lasting impact across federal missions. We work with a broad range of government agencies in the defense, intelligence, and federal civilian sectors.
At Noblis, we share a passion for excellence and innovation, and we create an environment where people can do meaningful work while maintaining the balance that keeps them energized and fulfilled. We seek out individuals with a natural curiosity and desire to collaborate and learn. We believe our people are our greatest strength, and we consistently seek exceptionally skilled, mission‑driven professionals who care deeply about doing work that enriches lives and makes our nation safer. Noblis has earned numerous workplace awards for our culture, our commitment to employee well‑being, and our dedication to meaningful, impactful work. We also maintain a drug‑free workplace. Remote/hybrid status is subject to change based on Noblis and/or government requirements.
Responsibilities
- Support systems security authorization and continuous monitoring activities for assigned systems.
- Support the preparation, review, and submission of security authorization packages, including SSPs, POA&Ms, and related authorization artifacts.
- System Patch Management: Utilize patch deployment tools and hardening guidelines to ensure security compliance of the customer's networked and cloud compute infrastructure.
- System Hardening: Apply and verify Security Technical Implementation Guides (STIGs) and vendor hardening guides to secure operating systems and applications.
- Vulnerability Scanning & Remediation: Conduct regular vulnerability scans to detect vulnerabilities and develop & implement remediation actions.
- Cloud Security: Experience with cloud-based patching and hardening techniques leveraging commercial cloud provider tools and best practices.
- Security & Configuration Management: Implement security controls (e.g. VLANs, firewall rules, and encryption) to protect network systems and data.
- Risk Management: Analyze vulnerability scan findings to identify risks, develop remediation plans, and track progress.
- Documentation: Maintain security documentation, including system baseline, hardening procedures, and all hardware software changes.
- Track systems risks, assessment findings, POA&M activities, and remediation status to ensure timely resolution.
- Facilitate recurring stakeholder meetings and provide compliance status updates, reporting, and risk summaries.
- Collaborate with FVEY partners to enhance security posture and best practices across a federated network.