Job Title: Information System Security Officer (ISSO)

Place of Performance: Bellevue, Nebraska (Omaha, Nebraska metropolitan area)

Mandatory Requirements: TS/SCI Clearance

Experience Level: Mid-Sr Level (3-8+ years)

On-Site, hybrid, remote: On-Site

Travel: Minimal / As Required

About JFL Consulting: With more than 20 years of securing some of the U.S. Department of Defense and the Intelligence Community’s most critical networks, JFL Consulting, LLC provides advanced network security solutions to a range of US Government and US commercial clients. Our cybersecurity operators are experts at assessing and defending mission-critical data and the networks that facilitate their operation. We are focused on delivering advanced products and industry best practices that meet each customer’s unique requirements. Visit www.jflconsulting.com

What We Offer:

• Salary: $120k - $140k
• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• We support your growth through certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms

Job Overview: JFL Consulting is seeking a skilled Information System Security Officer (ISSO) to support cybersecurity, Risk Management Framework (RMF), and system authorization activities across secure government environments. This position is focused on maintaining the security posture of assigned information systems throughout their lifecycle, supporting Authorization to Operate (ATO) and continuous monitoring activities, and ensuring compliance with applicable DoD cybersecurity requirements. Candidates should have hands-on experience with RMF processes, security documentation, vulnerability management, security control implementation and validation, and remediation activities.

Key Responsibilities:

Responsibilities - RMF & Authorization Support:

• Work directly with the Risk Management Framework (RMF) team (e.g., Information System Security Managers (ISSM), ISSOs, Cyber Security Engineers) supporting critical networks, and future RMF/Authorization to Operate (ATO) efforts.
• Maintain the security posture of assigned information systems throughout their lifecycle.
• Support RMF activities, including system authorization and reauthorization efforts.
• Support development, maintenance, and execution of RMF packages within eMASS, Xacta, or other applicable compliance tools.
• Ensure compliance with applicable cybersecurity policies, standards, and frameworks, including NIST guidance (Special Publication (SP) 800-53 Rev. 5) and Department of Defense cybersecurity requirements.
• Support Security Control Assessments (SCAs), audits, inspections, and authorization activities.
• Coordinate security control remediation efforts with ISSMs, Network / Systems Engineers, System Administrators and support maintenance of system authorization status.

Security Documentation & Compliance

• Develop, maintain, and review system security documentation, including:
• System Security Plans (SSPs)
• Plans of Action and Milestones (POA&Ms)
• Security Control Traceability Matrices (SCTMs)
• Review security configurations, system changes, and software deployments for cybersecurity and compliance impacts.
• Track and report cybersecurity metrics, vulnerabilities, incidents, remediation activities, and overall compliance status.
• Support continuous monitoring (ConMon) activities and associated documentation.
• Maintain accurate documentation necessary to support RMF, ATO, audit, and compliance requirements.

Vulnerability Management & Security Operations

• Monitor system vulnerabilities and ensure timely mitigation, remediation, and documentation.
• Support vulnerability assessments, security scanning, Security Technical Implementation Guide (STIG) implementation, and remediation activities using tools such as Nessus Pro, Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP), and EvaluateSTIG.
• Assist with incident response activities, investigations, and corrective actions.
• Validate security controls and system configurations to ensure continued compliance with established cybersecurity requirements.
• Identify cybersecurity risks and coordinate appropriate remediation with technical and program stakeholders.

Technical Coordination & Communication

• Coordinate with system owners, engineers, administrators, cybersecurity personnel, and other stakeholders to address security and compliance requirements.
• Communicate cybersecurity risks, vulnerabilities, compliance issues, and remediation requirements to technical (ISSM) and program leadership.
• Manage multiple systems, priorities, and authorization activities simultaneously.
• Produce clear and accurate technical documentation, reports, and cybersecurity status updates.

Requirements - Certifications:

• Required Baseline Certification: Active CompTIA Security+ CE certification is required as a minimum DoD 8140 baseline unless superseded by one or more of the advanced credentials below.
• Preferred / Qualifying Advanced Certifications: Holding any of the following satisfies the baseline requirement and is preferred to align with intermediate DoD Cyber Workforce Framework Role 722 (ISSM) or Role 612 (Security Control Assessor) responsibilities:
  • CISSP, CISM, CISA, or CGRC
  • CCSP or Cloud+
  • SecurityX (CASP+), CySA+, or PenTest+

Experience:

• 3-8+ years of information security, cybersecurity, or information technology experience.
• Hands-on experience supporting Department of Defense Risk Management Framework (RMF) processes and system authorization activities.
• Experience with vulnerability management, security scanning, STIG implementation, and remediation.
• Working knowledge of cybersecurity principles, security controls, and DoD compliance requirements.
• Experience supporting system authorization, reauthorization, and continuous monitoring activities.

Technical Skills:

• Working knowledge of NIST SP 800-53, NIST Risk Management Framework (RMF), Security Technical Implementation Guides (STIGs), Continuous Monitoring (ConMon), eMASS or similar compliance tools, Security Control Assessments (SCAs), and Authorization to Operate (ATO) packages.
• Understanding of cybersecurity risk management, security control validation, and compliance requirements.
• Familiarity with vulnerability assessment and remediation processes.
• Familiarity with incident response processes and corrective actions.

Communication:

• Strong written and verbal communication skills.
• Ability to develop and maintain clear technical and cybersecurity documentation.
• Ability to communicate security risks and compliance requirements to both technical and non-technical stakeholders.
• Ability to coordinate effectively across engineering, operations, cybersecurity, and program teams.

Preferred Education, Experience, & Skills:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent relevant experience.
• Experience supporting federal government or Department of Defense information systems.
• Experience supporting multiple RMF packages and ATO efforts.
• Experience with eMASS, Xacta, and DoD authorization processes.
• Familiarity with cloud security technologies and architectures.
• Demonstrated experience with cybersecurity risk management, RMF implementation, ATO support, vulnerability remediation, STIG compliance, audit/SCA support, incident response, security documentation, security control validation, and continuous monitoring.