[Hiring] Information Systems Security Officer @Piper Companies

Role Description

Zachary Piper Solutions is seeking an Information System Security Officer (ISSO) to support a federal and DoD cybersecurity mission. The ISSO will support the implementation, execution, and sustainment of RMF activities across secure information systems and cloud-based environments. This position focuses on hands-on cybersecurity authorization, security control implementation, eMASS documentation, vulnerability management, and continuous monitoring to maintain secure and authorized systems supporting federal and defense missions. The ISSO will work closely with ISSMs, ISSEs, system owners, engineers, & government stakeholders to support ATO packages, cybersecurity assessments, and ongoing authorization activities. The ideal candidate has hands-on DoD RMF experience, strong eMASS expertise, and a demonstrated ability to maintain security authorization documentation and remediate cybersecurity findings in complex federal environments.

• Execute and support the RMF lifecycle in accordance with NIST SP 800-37 & applicable DOD cybersecurity requirements
• Develop, maintain, & update SSPs, security control narratives, authorization artifacts, & supporting cybersecurity documentation
• Support the development, submission, maintenance, and sustainment of ATO packages using eMASS
• Implement, assess, and document security controls in accordance with NIST SP 800-53 and applicable DoD security control baselines
• Maintain POA&Ms, including vulnerability tracking, remediation milestones, corrective actions, and closure evidence
• Conduct ConMon activities to maintain system authorization and security compliance
• Review and analyze vulnerability assessment results from ACAS, Tenable Nessus, and other security scanning tools
• Support DISA STIG compliance, vulnerability remediation, patch management, and security hardening activities
• Identify security weaknesses, assess risks, coordinate remediation, and document corrective actions with system administrators and engineering teams
• Support security control assessments, evidence collection, testing, and validation activities in coordination with SCAs
• Maintain authorization boundaries, system inventories, ports, protocols, services, and cybersecurity documentation supporting system security posture
• Support security impact analyses and cybersecurity reviews associated with system changes, technology refreshes, migrations, and infrastructure modifications
• Assist with security categorization, control implementation, assessment, authorization, and ongoing authorization activities
• Coordinate with ISSMs, ISSEs, system owners, government stakeholders, and Authorizing Officials to support authorization requirements and resolve cybersecurity deficiencies
• Support cybersecurity incident response, vulnerability investigations, and security-related change management activities
• Maintain cybersecurity policies, procedures, standard operating procedures (SOPs), and operational documentation
• Support audit readiness, compliance reviews, and cybersecurity assessments across federal and DoD environments
• Support cloud security authorization activities and cybersecurity control mapping for AWS GovCloud and other cloud-based environments
• Assist with cybersecurity evidence collection and control mapping supporting cloud-native systems, containers, Kubernetes, and CI/CD environments
• Maintain accurate authorization records, security artifacts, vulnerability documentation, and compliance reporting within eMASS and other applicable GRC platforms

Qualifications

• 3-5+ years of hands-on experience supporting DoD cybersecurity, IA, RMF, or security authorization activities
• Direct experience serving as an ISSO or performing equivalent hands-on security authorization responsibilities
• Strong hands-on experience with eMASS, including maintaining authorization packages, security artifacts, control implementation documentation, and POA&Ms
• Experience supporting the DoD RMF authorization lifecycle, including security categorization, control implementation, assessment, authorization, and continuous monitoring
• Practical experience implementing, assessing, documenting, and maintaining NIST SP 800-53 security controls
• Experience developing and maintaining SSPs, security control narratives, POA&Ms, and authorization documentation
• Experience supporting ATO authorization, ATO sustainment, ongoing authorization, and continuous monitoring activities
• Experience reviewing and remediating cybersecurity vulnerabilities, including ACAS/Nessus findings, DISA STIGs, and security control deficiencies
• Familiarity with DISA security requirements, DoD cybersecurity policies, vulnerability management, and security compliance processes
• Ability to coordinate with ISSMs, ISSEs, system administrators, system owners, and government cybersecurity stakeholders
• Active IAMI or IATII certification (or able to obtain within 90 days)
• Active Secret Clearance

Preferred Qualifications

• Experience supporting AWS GovCloud authorization packages, particularly IL4, IL5, or IL6 environments
• Experience supporting cloud security authorization, cloud control implementation, or cloud security documentation
• Familiarity with AWS security services, cloud security controls, and cloud authorization boundaries
• Experience supporting containers, Kubernetes, CI/CD pipelines, DevSecOps environments, or continuous authorization initiatives
• Experience with additional GRC platforms such as Xacta, RegScale, CSAM, or ServiceNow GRC
• Experience with DISA Cloud Security Requirements Guide (SRG), FedRAMP, or cloud security compliance frameworks
• Experience with SIAs, significant change reviews, and authorization boundary updates
• Experience supporting SCAs, SARs, & SAPs
• Experience with vulnerability management tools such as ACAS, Tenable Nessus, SCAP Compliance Checker, or similar platforms
• Experience supporting classified DoD systems, federal information systems, or defense cybersecurity programs
• Experience supporting cybersecurity automation, compliance evidence generation, or automated security control monitoring
• Experience with cybersecurity incident response, security investigations, and remediation coordination
• Experience supporting cybersecurity modernization, cloud migration, or system lifecycle activities
• Strong written communication, documentation, analytical, and organizational skills
• Ability to work collaboratively across cybersecurity, engineering, and government teams

Compensation

• Salary Range: $150,000-170,000 depending on experience
• Benefits including an annual bonus (10%), equity opportunities, medical benefits (100% employer-paid), unlimited PTO, paid federal holidays, home-office stipend, and more