SMX is seeking an Intermediate Information System Security Officer (ISSO) to serve as the security compliance and risk lead for one or more cloud-based and/or classified systems. The ISSO will support the information assurance program for a program, organization, system, or enclave, ensuring alignment with NIST SP 800-53, FedRAMP, and the NIST Risk Management Framework (RMF).

Working under the direction of senior ISSOs and the Information System Security Manager (ISSM), the ISSO will manage the security authorization and continuous monitoring lifecycle, maintain the operational security posture of assigned systems, perform day-to-day security operations, and partner with engineering teams to integrate security into DevSecOps practices. This role serves as a collaborator amongst internal stakeholders, cross-functional teams, 3PAOs, and ISV customers. This is a fully remote position open to candidates across the United States.

Essential Skills

•    Support the broader Information Assurance program for assigned system(s), program(s), or enclave(s).
•    Propose, coordinate, implement, and enforce information systems security policies, standards, and methodologies.
•    Develop and maintain core RMF documentation, including the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), POA&Ms, Risk Assessment Reports, System Requirements Traceability Matrices (SRTMs), FedRAMP appendixes, and Continuous Monitoring Strategy.
•    Support system authorization and re-authorization efforts under RMF Steps 1–6, and obtain/maintain system authorizations (ATOs) for systems under purview.
•    Maintain the operational security posture of assigned information system.
•    Provide support to the Senior ISSO or ISSM to maintain the appropriate operational cybersecurity posture for a system, program, or enclave.
•    Evaluate security solutions to ensure they meet requirements for processing classified and/or sensitive information.
•    Perform vulnerability/risk assessment analysis to support security authorization.
•    Support annual 3PAO assessments and security audits.
•    Support the response to security incidents and work with incident response teams to ensure compliance with associated controls.
•    Collaborate with Coss functional to implement security controls in cloud environments.
•    Evaluate and document significant change requests (SCRs) and assess the security impact of changes to the system.
•    Support Continuous Monitoring (ConMon) activities to ensure timely reporting, remediation, and POA&M updates.
•    Interact with customers and cross-functional teams to define and achieve required cybersecurity objectives.
•    Collaborate with cybersecurity staff and ensure alignment with evolving federal security requirements.

Required Skills & Experience 

Required Qualifications
•    U.S. Citizen with the ability to obtain and maintain a Secret clearance.
•    5+ years of experience in cybersecurity, with at least 2 years as an ISSO in a cloud, federal, DoD, or Intelligence Community environment.
•    Working knowledge of NIST SP 800-53 (Rev 5) and FedRAMP Moderate/High.
•    Experience with RMF steps and authoring SSPs, POA&Ms, DRs and related authorization documentation.
•    Experience with security policy authoring/review and working with 3PAOs, commercial customers, and federal agencies.
•    Ability to work effectively in a 100% remote, distributed-team environment.

• Security + Certification

Desired Skills & Experience

•    FedRAMP, DoD, or DISA experience with ATO processes.
•    Security+ certification (or equivalent DoD 8570/8140 baseline certification).
•    Experience managing or interpreting vulnerability scanning results and integrating them with POA&M workflows.
     Key Competencies
•    Strong analytical and documentation skills.
•    Excellent communication and stakeholder management.
•    Ability to balance technical depth with business/mission requirements.
•    Risk-based decision-making and a continuous improvement mindset.
•    Self-directed and able to collaborate effectively across a remote, cross-functional team.

#CJPOST