Information Systems Security Officer

We are seeking an experienced Information Systems Security Officer (ISSO) to support cybersecurity compliance and accreditation activities supporting a Department of Defense (DoD) cloud environment.

The ideal candidate will possess extensive experience navigating the Navy Authorization to Operate (ATO) process and will serve as a cybersecurity resource responsible for guiding the system through the DoD Risk Management Framework (RMF) lifecycle.

This position will work closely with government stakeholders, engineering teams, cloud architects, and program leadership to achieve and maintain authorization while ensuring compliance with DoD cybersecurity requirements.

• Lead cybersecurity activities throughout the DoD Risk Management Framework (RMF) lifecycle.
• Manage the development, review, and maintenance of RMF artifacts and authorization documentation.
• Serve as the primary ISSO supporting the achievement of a Navy Authorization to Operate (ATO).
• Coordinate directly with government Authorizing Officials (AO), Information System Security Managers (ISSM), validators, and cybersecurity representatives.
• Build and maintain effective working relationships with Navy cybersecurity organizations to facilitate the authorization process.
• Utilize eMASS to manage security controls, documentation, findings, and authorization packages.
• Coordinate Security Technical Implementation Guide (STIG) implementation and validation across Windows, Linux, networking, and cloud environments.
• Conduct security control assessments against NIST SP 800-53 requirements.
• Support vulnerability management, POA&M development, and continuous monitoring activities.
• Collaborate with engineering teams to implement secure cloud architectures within Azure Government and/or AWS GovCloud.
• Assist with DoD Cloud Security Requirements Guide (SRG) compliance activities.
• Support future Secret-level accreditation efforts and classified system expansion.
• Provide cybersecurity guidance throughout system design, implementation, and operational phases.
• Develop executive-level status reports and communicate cybersecurity risks to technical and non-technical stakeholders.