Information Systems Security Officer (ISSO)

About the Role

The Information Systems Security Officer (ISSO) is responsible for the security, compliance, and operational integrity of MSI Defense Solutions' information systems supporting both classified and unclassified environments. The ISSO serves as the primary cybersecurity and information assurance lead, ensuring systems comply with DoD Risk Management Framework (RMF), NIST SP 800-171, NIST SP 800-53, CMMC, and other applicable federal security requirements. This position partners closely with Information Technology, Security, Engineering, Program Management, and government customers to integrate cybersecurity requirements throughout the system lifecycle. The ISSO will report to the Digital Technology Manager.

Responsibilities

• Serve as the Information Systems Security Officer (ISSO) for classified and unclassified information systems.
• Maintain compliance with the DoD Risk Management Framework (RMF), NIST SP 800-53, NIST SP 800-171, CMMC, and applicable DoD cybersecurity policies.
• Develop, maintain, and update System Security Plans (SSPs), POA&Ms, Security Assessment Reports (SARs), and RMF documentation.
• Administer and maintain the organization's Governance, Risk, and Compliance (GRC) platform (e.g., IntelliGRC), ensuring security documentation, evidence, POA&Ms, and assessment artifacts remain current and audit ready.
• Support Authorization to Operate (ATO), Authority to Connect (ATC), and continuous monitoring activities.
• Ensure implementation and maintenance of required security controls across enterprise systems.
• Conduct vulnerability assessments, security audits, and remediation tracking.
• Coordinate vulnerability scanning, patch management, and secure system configuration.
• Investigate, document, and coordinate cybersecurity incident response activities.
• Administer user access controls and privileged account management in accordance with least privilege principles.
• Ensure compliance with security requirements for classified systems and secure facilities.
• Lead the preparation for internal audits, DCSA assessments, customer inspections, and CMMC assessments including evidence collection, artifact management, and assessor coordination.
• Collaborate with IT, Engineering, and Program teams to integrate cybersecurity throughout project execution.
• Develop and maintain cybersecurity policies, procedures, and user awareness initiatives.
• Support secure implementation of Microsoft 365 GCC High, Azure, Microsoft Defender, Intune, and related security technologies.
• Serve as the primary cybersecurity liaison for government customers and external auditors.
• Monitor compliance status, track remediation activities, and provide regular reporting on cybersecurity posture and outstanding compliance actions to leadership.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).
• 5+ years of cybersecurity, information assurance, or information systems security experience within a DoD or federal contractor environment.
• Strong knowledge of:
  • DoD Risk Management Framework (RMF)
  • NIST SP 800-53
  • NIST SP 800-171
  • CMMC Level 2
  • STIG implementation
• Experience managing Authorization to Operate (ATO) packages.
• Experience supporting classified information systems.
• Experience administering Microsoft 365 GCC High, Azure Active Directory, Microsoft Defender, Intune, and endpoint security solutions.
• Experience conducting vulnerability management and remediation.
• Familiarity with SIEM solutions and continuous monitoring tools.
• Excellent documentation and technical writing skills.
• Strong communication and collaboration skills.
• U.S. Citizenship is required.
• An active Secret security clearance is required.
• Must be able to maintain eligibility for access to classified information.

Preferred Qualifications

• Experience supporting CMMC Level 2 environments or similar regulated environments.
• Familiarity with tools such as Microsoft Defender, SIEM platforms, and compliance tools (e.g., IntelliGRC).
• Relevant certifications (Security+, CySA+, CISSP, or similar).
• Experience with audit preparation and evidence collection.

Schedule

Full-time, hybrid with 3 days onsite. Normal hours are Monday through Thursday 7:00am-4:30pm and Friday 7:00am - 12:00pm. Must be flexible to work additional hours as needed based on project requirements and deadlines.

Physical Requirements

• Prolonged periods sitting at a desk and working on a computer.
• Must be able to lift up to 30 pounds at times.
• Must be able to access and navigate each department at the organization's facilities.

Company Values

Every employee at MSI is expected to operate in accordance with the MSI Operating Code. These seven principles define how we think, decide, and execute:

• Own It. If a problem touches your function, it is yours until it is solved or explicitly transferred. Ownership means driving to resolution, not monitoring status.
• Kill the Wrong Fight. Before optimizing a solution, question whether the problem is yours to solve. If an opportunity requires MSI to become something we are not, kill it fast.
• Move Before You're Told. Speed is MSI's compounding advantage. We move when directionally correct and adjust in motion.
• Solve Before You Contract. Prove the integration works before formalizing the relationship. Capability first, paperwork follows.
• Integrate First. MSI's moat is the ability to integrate modular systems faster and more effectively than anyone else.
• Say It Now. Silence is not alignment. If you disagree, say so, with data, with reasoning, and with an alternative path.
• Build Beyond Yourself. If your function depends on your presence to operate, you have not built anything. Develop your people and processes.

Benefits

• 401(k) with employer match
• Dental Insurance
• Disability Insurance
• Health Insurance
• Vision Insurance
• Paid Parental and Maternity Leave
• Life Insurance
• Paid Time Off - 120 hours per year to start (prorated in first year of employment)
• Continuing Education
• Annual Year End Paid Holiday Closure