Information Systems Security Officer
- Salary
- $150K–$170K
- Hiring from
- United States
- Work type
- Remote
- Posted
627,268 remote jobs, straight from company career pages
100% free · New jobs every minute
Show job descriptionHide job description
Zachary Piper Solutions is seeking an Information Systems Security Officer (ISSO) to manage security authorization and continuous monitoring for cloud systems supporting federal defense missions. This is a full-time, direct-hire, remote position for candidates who reside in an approved hiring hub: Washington, DC / Maryland / Virginia or Denver / Colorado Springs, CO. The role requires an active Secret security clearance at minimum.
You’ll own authorization packages for DoD Impact Level 4 and 5 environments, work with engineers to close security findings, and keep systems ready for assessment and authorization review.
Responsibilities for the ISSO include:
You’ll own authorization packages for DoD Impact Level 4 and 5 environments, work with engineers to close security findings, and keep systems ready for assessment and authorization review.
Responsibilities for the ISSO include:
- Carry out the DoD Risk Management Framework (RMF) lifecycle, from system categorization and control selection through implementation, assessment, authorization, and continuous monitoring.
- Build and maintain eMASS authorization packages, keeping control implementation records, test results, supporting evidence, and monitoring status current.
- Write and update System Security Plans (SSPs), control narratives, Plans of Action and Milestones (POA&Ms), and other documentation that reflects how systems are designed and operated.
- Manage DISA Ports, Protocols, and Services Management (PPSM) registrations. Reconcile system inventories, data flows, and authorization boundaries with applicable requirements.
- Coordinate continuous monitoring, including monthly POA&M updates, vulnerability and patch reporting, Information Assurance Vulnerability Management (IAVM) tracking, and periodic assessments.
- Validate DISA STIG compliance, review ACAS and Tenable Nessus findings, and work with engineering and system administration teams to document corrective actions and verify closure.
- Evaluate the security impact of system changes, technology refreshes, and cloud migrations. Support incident response and update security procedures and authorization records as needed.
- Partner with product and engineering teams to map AWS, container, Kubernetes, and CI/CD controls to NIST SP 800-53 requirements and collect evidence that shows how those controls operate.
- Serve as a technical point of contact for Information Systems Security Managers (ISSMs), Security Control Assessors (SCAs), and Authorizing Officials during assessments, readiness reviews, and audits.
Required Qualifications for the ISSO include:
- 3–5 years of hands-on experience in DoD cybersecurity, information assurance, or RMF authorization, including direct experience as an ISSO or in an equivalent role supporting DoD Authorization to Operate (ATO) packages.
- Hands-on experience building and maintaining authorization packages in eMASS or a comparable governance, risk, and compliance (GRC) platform.
- Practical knowledge of NIST SP 800-37, NIST SP 800-53 Rev. 4 or 5, and DoD guidance for implementing, assessing, and documenting security controls.
- Experience writing SSPs and control narratives, maintaining POA&Ms, and supporting continuous monitoring and ATO sustainment.
- Working knowledge of DISA PPSM, the Category Assurance List (CAL), and authorization boundary and data-flow documentation.
- Familiarity with DISA STIGs, STIG Viewer or SCAP Compliance Checker, ACAS, IAVM, and the DISA Cloud Computing Security Requirements Guide.
- Understanding of how AWS, containers, Kubernetes, and CI/CD pipelines map to technical security controls.
- Strong technical writing skills and the ability to coordinate remediation and evidence collection with engineering, security, and government teams.
- Active Secret security clearance at minimum.
- Qualifying DoD IAM Level I or IAT Level II certification, such as Security+ or CISSP, or the ability to obtain a qualifying certification within 90 days.
- Active TS/SCI security clearance.
- Experience supporting AWS GovCloud authorizations, particularly in DoD IL4, IL5, or IL6 environments.
- Experience with cloud control validation, FedRAMP, DevSecOps, or automated compliance evidence collection.
- Experience with additional GRC tools such as Xacta, RegScale, CSAM, or ServiceNow GRC.
- Experience supporting significant change reviews, security impact analyses, or the preparation of Security Assessment Plans (SAPs) and Security Assessment Reports (SARs).
- Salary Range: $150,000–$170,000 per year, depending on experience.
- Additional Compensation: Potential eligibility for equity awards and a discretionary bonus.
- Full Benefits Package: 100% employer-paid medical, dental, and vision coverage for employees and dependents; 401(k) with a 3% company contribution; flexible PTO and paid federal holidays; parental leave; wellness and family planning benefits; a new hire technology and home office stipend; an annual professional development stipend; and an employee referral bonus program.
This job opens for applications on 11/13/2026. Applications will be reviewed on a rolling basis, and the position will remain open until filled.
Keywords: Information Systems Security Officer, Information System Security Officer, ISSO, Cloud ISSO, DoD ISSO, RMF Analyst, A&A Analyst, Information Assurance, DoD Cybersecurity, Federal Cybersecurity, Risk Management Framework, RMF, Assessment and Authorization, ATO Package Management, ATO Sustainment, eMASS, GRC, Xacta, RegScale, CSAM, ServiceNow GRC, NIST SP 800-37, NIST SP 800-53, Security Control Implementation, Control Narratives, SSP, SAP, SAR, POA&M, Continuous Monitoring, ConMon, PPSM, CAL, Authorization Boundary, DISA STIG, STIG Viewer, SCAP Compliance Checker, ACAS, Tenable Nessus, IAVM, Vulnerability Remediation, Security Impact Analysis, AWS GovCloud, DoD IL4, DoD IL5, DoD IL6, Cloud Security Authorization, DISA Cloud Computing SRG, FedRAMP, Kubernetes, DevSecOps, CI/CD, IAM Level I, IAT Level II, Security+, CISSP, Active Secret Clearance, TS/SCI, Remote ISSO, Washington DC, Maryland, Virginia, DMV, Denver, Colorado Springs
Keywords: Information Systems Security Officer, Information System Security Officer, ISSO, Cloud ISSO, DoD ISSO, RMF Analyst, A&A Analyst, Information Assurance, DoD Cybersecurity, Federal Cybersecurity, Risk Management Framework, RMF, Assessment and Authorization, ATO Package Management, ATO Sustainment, eMASS, GRC, Xacta, RegScale, CSAM, ServiceNow GRC, NIST SP 800-37, NIST SP 800-53, Security Control Implementation, Control Narratives, SSP, SAP, SAR, POA&M, Continuous Monitoring, ConMon, PPSM, CAL, Authorization Boundary, DISA STIG, STIG Viewer, SCAP Compliance Checker, ACAS, Tenable Nessus, IAVM, Vulnerability Remediation, Security Impact Analysis, AWS GovCloud, DoD IL4, DoD IL5, DoD IL6, Cloud Security Authorization, DISA Cloud Computing SRG, FedRAMP, Kubernetes, DevSecOps, CI/CD, IAM Level I, IAT Level II, Security+, CISSP, Active Secret Clearance, TS/SCI, Remote ISSO, Washington DC, Maryland, Virginia, DMV, Denver, Colorado Springs
