Information System Security Officer (ISSO) (DoD/RMF)

Location: Remote, United States; periodic travel may be required for assessments, customer meetings, and access to approved facilities. Classified work must be performed in approved facilities. Applicants must be eligible for a U.S. Government security clearance; only U.S. citizens are eligible.

Salary: $92,075–$158,138

Company

hirify.global is a digital solutions provider delivering technology, prototypes, commercial-grade platforms, and mission-ready AI to federal agencies across defense, space, healthcare, and energy.

What you will do

• Maintain System Security Plans, control implementation statements, system inventories, authorization boundaries, network and data-flow diagrams, and supporting records in eMASS or another approved system.
• Coordinate RMF activities, system categorization, control selection, inherited and system-specific controls, evidence collection, assessments, and ATO packages for initial authorization, renewals, and system changes.
• Manage POA&Ms, remediation actions, vulnerability findings, STIG checklists, security advisories, validation evidence, and risk documentation.
• Execute continuous monitoring activities, including control reviews, scan schedules, account reviews, audit-log reviews, configuration checks, and reporting.
• Evaluate application, infrastructure, interface, and data-flow changes for security impact and coordinate additional authorization or assessment requirements.
• Work with ISSMs, government system owners, assessors, cloud, platform, software, and cybersecurity engineers to support audits, inspections, evidence collection, incident reporting, access reviews, contingency planning, and recovery exercises.

Requirements

• Active Secret security clearance and ability to obtain and maintain Top Secret clearance if required by the assignment.
• At least five years of relevant experience as an ISSO, ISSM, cybersecurity compliance professional, or equivalent practitioner supporting DoD information systems.
• Hands-on experience preparing and maintaining DoD RMF authorization packages, including security-control documentation, assessment support, POA&M management, and ATO sustainment.
• Experience using eMASS, Xacta, or a comparable government authorization system to manage control responses, assessment evidence, findings, and authorization records.
• Working knowledge of NIST SP 800-53 controls, DISA STIGs, vulnerability management, continuous monitoring, and DoD authorization requirements.
• Ability to interpret vulnerability scans, technical configurations, system diagrams, and assessment findings and coordinate evidence-based remediation with engineers and system owners.
• Working knowledge of operating systems, networking, identity and access management, encryption, configuration management, and logging sufficient to evaluate security-control implementation.
• Current cybersecurity certification relevant to the duties and ability to meet applicable DoD 8140 work-role and proficiency-level requirements within customer timelines.
• Strong technical writing, documentation, organization, stakeholder coordination, independent-work, concurrent-deadline, and sensitive-information-protection skills.
• Ability to support periodic travel and perform classified duties at approved facilities. A college degree is not required.

Nice to have

• Experience supporting authorizations for AWS GovCloud, Azure Government, or another government-authorized cloud environment, including control inheritance and shared-responsibility documentation.
• Experience supporting DoD Impact Level 4, 5, or 6 systems, including mission applications, data platforms, or robotics and autonomous systems environments.
• Familiarity with Kubernetes, containers, DevSecOps, automated security evidence, software supply-chain controls, or application onboarding requirements for authorized platforms.
• Experience supporting Special Operations Forces, combatant commands, military service components, or Intelligence Community mission partners.
• Experience supporting independent security control assessments or continuous monitoring across multiple systems.
• CGRC, CISSP, CISM, or a related advanced cybersecurity certification.
• Bachelor’s or master’s degree in cybersecurity, information systems, computer science, or a related discipline.

Culture & Benefits

• Remote work with periodic travel for assessments, customer meetings, and approved-facility access.
• Collaboration with government system owners, assessors, ISSMs, and engineering teams in a distributed environment.
• Work supporting federal missions across defense, space, healthcare, and energy.