Information System Security Officer Level II

Required Qualifications

• Five (5) or more years of cybersecurity experience, including at least three (3) years performing ISSO or equivalent RMF duties in a federal environment.
• Hands-on experience preparing and maintaining A&A packages under NIST SP 800-37.
• Experience creating, tracking, and closing POA&Ms and maintaining supporting artifacts.
• Experience running or interpreting STIG-based compliance assessments and vulnerability scans.
• Experience maintaining cybersecurity documentation within a Government A&A tracking tool.
• Certification
• Must hold and maintain at least one active certification approved for Information Assurance Management (IAM) Level I or Level II. Any one of the following satisfies the requirement: CGRC - Governance, Risk and Compliance Certification (formerly CAP) CISSP - Certified Information Systems Security Professional (or CISSP Associate) CISM - Certified Information Security Manager CASP+ - CompTIA Advanced Security Practitioner GSLC - GIAC Security Leadership Certification Security+ CE - CompTIA Security+ Continuing Education (Level I only)
• CGRC - Governance, Risk and Compliance Certification (formerly CAP)
• CISSP - Certified Information Systems Security Professional (or CISSP Associate)
• CISM - Certified Information Security Manager
• CASP+ - CompTIA Advanced Security Practitioner
• GSLC - GIAC Security Leadership Certification
• Security+ CE - CompTIA Security+ Continuing Education (Level I only)
• Certification requirements are subject to confirmation against COMDTINST M2620.2 (series) Appendix D, the controlling USCG certification matrix. Verify the accepted certification list with the Program Manager before extending an offer.
• Evidence of active certification in good standing is required prior to onboarding. Waivers and exceptions to certification requirements will not be granted.
• Certifications must remain current, active, and in good standing throughout performance. Loss, lapse, or revocation of a required certification is grounds for removal from the contract. Continuing education required to maintain certification is at the employee's and company's expense.
• Other
• Ability to work directly with system administrators and Government stakeholders to drive remediation.
• Strong written communication: the role produces bi-weekly written reporting and briefs the ISSM monthly.
• Ability to read, write, speak, and understand English fluently.

Preferred Qualifications

• Prior USCG, DHS, or DoD ISSO experience.
• Exposure to OT/ICS or Platform IT environments.
• Familiarity with COMDTINST M2620.2 (series).
• CGRC (formerly CAP) in addition to the required baseline certification.
• Experience with contingency planning and disaster recovery testing.
• Bachelor's degree in a cybersecurity or technical discipline.

Technical Skills

• NIST SP 800-37 (RMF), 800-53 / 53A / 53B, 800-137 (ISCM), FIPS 199 and FIPS 200
• DHS 4300A Sensitive Systems Handbook and the DHS Systems Engineering Life Cycle (SELC)
• Government-designated A&A repositories and tracking tools (e.g., eMASS or successor)
• DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)
• Government-approved vulnerability scanning and compliance tooling (e.g., ACAS/Nessus, SCAP-validated scanners)
• POA&M development, tracking, and closure, including waiver and risk acceptance packages
• Operational Technology (OT), Platform IT (PIT), and industrial control system environments, including constraints on agent-based tooling
• Security Impact Assessments and change management board participation
• Interconnection documentation: ISAs, MOUs, SLAs
• Contingency planning, contingency plan testing, and disaster recovery failover exercises
• Audit log review, audit trigger configuration, and incident reporting workflows
• Security Readiness Reviews for operating systems and applications

Education

Work Environment