Junior Information System Security Officer

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments. Dragonfli Group is seeking a Junior Information System Security Officer (ISSO) to support a multi-year cybersecurity program for a large federal agency. You will develop and maintain System Security Plans and the related security documentation that carries systems through authorization, and you will support the activities that help those systems obtain and maintain an Authorization to Operate. Day to day, you will be the security point of contact for software developers, project managers, and other team members inside your ATO boundary, helping them find practical ways to meet security requirements without stalling delivery. This role suits someone with roughly 2 years of ISSO experience who wants ownership of real systems while working under the guidance of a lead or senior ISSO.\ This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S. This position is fully remote. The agency's Rules of Behavior and Telework Policy apply to all contractor personnel and require, among other things, that laptop cameras be turned on and that staff remain visible on camera during all meetings. ResponsibilitiesDevelop and maintain System Security Plans (SSPs) and related security documentationSupport the activities that help systems obtain and maintain an Authorization to Operate (ATO)Assist with oversight of the information systems security program for applications and systems within the ATO boundaryProvide day-to-day security support and guidance to software developers, project managers, and other team membersHelp identify practical ways to meet security requirements with minimal impact to delivery schedulesEscalate complex or ambiguous security issues to the lead or senior ISSO with the context needed to resolve themSupport execution of Risk Management Framework tasks including categorization, control selection, implementation, assessment, and authorization in accordance with NIST SP 800-37Support continuous monitoring activities and keep authorization artifacts currentSupport System Owner system access reviews and account management complianceContribute to the use of automation and AI tooling that streamlines RMF documentation and control assessment work Requirements: Must-HaveBachelor's degree in cybersecurity, information technology, or a related field2 years of ISSO experience, including hands-on work developing or maintaining System Security PlansWorking knowledge of the Risk Management Framework and the federal authorization process (ATO)Familiarity with NIST SP 800-37 and NIST SP 800-53 control familiesAbility to explain security requirements clearly to developers and project managersU.S. Citizenship or Permanent Residency, with all work performed within the continental U.S.Ability to pass a federal agency suitability or background investigation Preferred / Nice-to-HavePrior federal contracting experience supporting a civilian agency ATO boundaryExperience with a GRC platform such as Xacta, eMASS, CSAM, Archer, or ServiceNow IRMExposure to FedRAMP-authorized cloud services and inherited control modelsExperience supporting POA&M tracking and remediationFamiliarity with Ongoing Authorization or continuous ATO modelsCertifications such as Security+, CGRC (formerly CAP), or CISSP Associate Skill(s): Technical SkillsSystem Security Plan (SSP) authoring and maintenanceRisk Management Framework execution under NIST SP 800-37NIST SP 800-53 control selection, implementation, and evidence mappingAuthorization package assembly and ATO lifecycle supportPOA&M tracking and remediation coordinationContinuous monitoring and security documentation upkeepGRC tooling (Xacta, eMASS, CSAM, Archer, or ServiceNow IRM)Cloud service authorization concepts, including FedRAMP inheritance Soft SkillsClear written and verbal communication with both technical and non-technical audiencesAbility to work independently and as a contributing member of a distributed teamComfort operating in a fully remote setting with a camera-on meeting cultureSound judgment about when to decide and when to escalateCollaborative posture with system owners, business owners, developers, and assessorsAttention to documentation quality and follow-through on commitments Benefits: Dragonfli Group offers a comprehensive benefits package that includes:Medical: Multiple POS health plan options including an HSA-compatible planDental: PPO coverage for preventive, basic, and major servicesVision: Annual exam, frames, lenses, and contact lens allowance401(k): Employer match up to 5% of eligible compensationLong-Term Disability: 100% employer-paid coverage at 50% of pre-disability earningsLife Insurance & AD&D: 100% employer-paid coverage valued at $10,000 eachPTO: 15–25 days annually based on tenurePaid Federal Holidays: All 11 federal holidays observed