Information Systems Security Officer (ISSO)

Second Front Systems is looking for a detail-oriented, mission-focused, technically grounded Information Systems Security Officer (ISSO) to strengthen our cybersecurity and DevSecOps organization.

Operating at DoD IL4/IL5 authorization environments and continuous monitoring operations, you will be responsible for executing the RMF lifecycle, maintaining Game Warden and supporting system authorizations across DoD ATO programs, and ensuring security posture withstands assessor and Authorizing Official scrutiny.

You will build and maintain eMASS packages, manage PPSM registrations, drive POA&M remediation with engineering, and conduct continuous monitoring operations, ensuring that Game Warden and supporting systems remain accredited and compliance-ready in DoD environments.

We need someone capable of translating dense DoD policy and RMF guidance into actionable technical direction for engineers; bridging compliance requirements with cloud-native architecture patterns (AWS, Kubernetes, CI/CD); and authoring assessor-ready RMF artifacts and control narratives that survive scrutiny from ISSMs and Authorizing Officials.

As a key partner to ISSMs, assessors, Authorizing Officials, and Product and Engineering teams, you will maintain authorization packages, manage continuous monitoring workflows, and ensure defensible evidence collection across accredited systems, serving as the technical authority on DoD RMF execution and compliance posture for our platform.

Note: Candidates must reside in one of our approved hiring hubs:
• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do
• Execute all phases of NIST SP 800-37 DoD RMF lifecycle—categorization, control selection, implementation, assessment, authorization, and continuous monitoring—for systems in DoD IL4/IL5 environments.
• Own eMASS authorization packages end-to-end, populating control implementation details, test results, artifacts, and continuous monitoring status to keep packages assessor-ready.
• Manage DISA PPSM registrations, reconciling ports, protocols, and services data flows to align with CAL and boundary architecture.
• Author System Security Plans, control implementation narratives, Plans of Action & Milestones, and supporting RMF artifacts that reflect cloud architecture and operating reality.
• Drive continuous monitoring operations—monthly POA&M updates, vulnerability and patch reporting, IAVM compliance, significant change reviews, periodic assessments—and push findings to closure with engineering.
• Validate STIG compliance and analyze vulnerability scan results from ACAS/Tenable Nessus, tracking remediation against NIST 800-53 and DoD requirements.• Serve as technical point of contact for ISSMs, assessors, and Authorizing Officials during assessments, readiness reviews, and audits.• Partner with Product and Engineering to map cloud-native controls—AWS, containers, Kubernetes, CI/CD pipelines—to DoD RMF and NIST 800-53 requirements with defensible evidence.• 3–5 years hands-on DoD cybersecurity, RMF authorization, or information assurance experience, with direct ISSO or equivalent compliance role supporting DoD ATO packages.• Demonstrated proficiency building and maintaining authorization packages in eMASS.• Working knowledge of DISA PPSM registration, ports, protocols, services process, CAL, and boundary/data-flow documentation.• Strong practical knowledge of NIST 800-53 (Rev 4/5), NIST 800-37 RMF, and DoD-specific implementation guidance.• Familiarity with DoD tools and policies governing authorizations: DISA STIGs, STIG Viewer/SCC, ACAS, IAVM, DISA Cloud Computing SRG, and continuous monitoring standards.• Solid understanding of modern cloud environments (AWS, containers, Kubernetes, CI/CD) and how cloud-native patterns map to technical security controls.• Strong written communication skills to produce assessor-ready documentation and clear control narratives.• Active U.S. Secret security clearance required; DoD 8570/8140 IAM Level I or IAT Level II baseline certification (Security+, CISSP, or equivalent) required or obtainable within 90 days.• U.S. citizenship is required for this role.