Information Systems Security Officer – ISSO

This is a fully remote position, open to applicants in Colorado, +2 more states.

📋 Description

• Oversee all stages of the NIST SP 800-37 DoD RMF lifecycle for systems operating in DoD IL4/IL5 environments.

• Manage eMASS authorization packages from start to finish, including details on control implementation, test outcomes, artifacts, and ongoing monitoring status.

• Supervise DISA PPSM registrations and coordinate the reconciliation of ports, protocols, services, data flows, CAL, and boundary architecture.

• Draft System Security Plans, narrate control implementations, create Plans of Action & Milestones, and produce supporting RMF artifacts.

• Lead continuous monitoring efforts, which encompass monthly updates to POA&M, vulnerability and patch reporting, IAVM compliance checks, significant change reviews, and periodic assessments.

• Confirm STIG compliance and evaluate ACAS/Tenable Nessus vulnerability scan outcomes, keeping track of remediation in accordance with NIST 800-53 and DoD standards.

• Act as the technical liaison for ISSMs, assessors, and Authorizing Officials during assessments, readiness evaluations, and audits.

• Collaborate with Product and Engineering teams to align AWS, containers, Kubernetes, and CI/CD controls with DoD RMF and NIST 800-53 requirements.

• Ensure the maintenance of authorization packages and the collection of defensible evidence across accredited systems.

⛳️ Requirements

• 3–5 years of practical experience in DoD cybersecurity, RMF authorization, or information assurance, with direct involvement in an ISSO or similar compliance role supporting DoD ATO packages.

• Proven expertise in creating and managing authorization packages in eMASS.

• Familiarity with DISA PPSM registration processes, including ports, protocols, services, CAL, and boundary/data-flow documentation.

• Strong working knowledge of NIST 800-53 (Rev 4/5), NIST 800-37 RMF, and DoD-specific implementation guidelines.

• Understanding of DISA STIGs, STIG Viewer/SCC, ACAS, IAVM, DISA Cloud Computing SRG, and continuous monitoring standards.

• Comprehensive understanding of AWS, containers, Kubernetes, and CI/CD, along with how cloud-native patterns correspond to technical security controls.

• Excellent written communication skills to generate assessor-ready documentation and articulate control narratives clearly.

• An active U.S. Secret security clearance is required.

• DoD 8570/8140 IAM Level I or IAT Level II baseline certification (Security+, CISSP, or equivalent) is required or must be obtainable within 90 days.

• U.S. citizenship is required.

• Candidates must reside in an approved hiring hub: DC/Maryland/Virginia or Denver/Colorado Springs, CO.

🏝️ Benefits

• Potential eligibility for equity awards.

• Discretionary bonuses.

• 100% employer-paid medical, dental, and vision coverage for you and your dependents.

• 401(k) plan with a 3% company contribution.

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more.

• Equity incentive plan.

• Stipend for new hire technology and home office setup.

• Annual professional development stipend.

• Flexible paid time off, in addition to all federal holidays.

• Generous parental leave policy.

• Flexible remote work opportunities.

• Employee referral bonus program.