Information Systems Security Officer (ISSO)

Information Systems Security Officer (ISSO)

The company is looking for a detail-oriented, mission-focused, technically grounded Information Systems Security Officer (ISSO) to strengthen our cybersecurity and DevSecOps organization.

Operating at DoD IL4/IL5 authorization environments and continuous monitoring operations, you will be responsible for executing the RMF lifecycle, maintaining Game Warden and supporting system authorizations across DoD ATO programs, and ensuring security posture withstands assessor and Authorizing Official scrutiny.

You will build and maintain eMASS packages, manage PPSM registrations, drive POA&M remediation with engineering, and conduct continuous monitoring operations, ensuring that Game Warden and supporting systems remain accredited and compliance-ready in DoD environments.

We need someone capable of translating dense DoD policy and RMF guidance into actionable technical direction for engineers; bridging compliance requirements with cloud-native architecture patterns (AWS, Kubernetes, CI/CD); and authoring assessor-ready RMF artifacts and control narratives that survive scrutiny from ISSMs and Authorizing Officials.

As a key partner to ISSMs, assessors, Authorizing Officials, and Product and Engineering teams, you will maintain authorization packages, manage continuous monitoring workflows, and ensure defensible evidence collection across accredited systems, serving as the technical authority on DoD RMF execution and compliance posture for our platform.

Note: Candidates must reside in one of our approved hiring hubs

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Execute all phases of NIST SP 800-37 DoD RMF lifecycle—categorization, control selection, implementation, assessment, authorization, and continuous monitoring—for systems in DoD IL4/IL5 environments.
• Own eMASS authorization packages end-to-end, populating control implementation details, test results, artifacts, and continuous monitoring status to keep packages assessor-ready.
• Manage DISA PPSM registrations, reconciling ports, protocols, and services data flows to align with CAL and boundary architecture.
• Author System Security Plans, control implementation narratives, Plans of Action & Milestones, and supporting RMF artifacts that reflect cloud architecture and operating reality.
• Drive continuous monitoring operations—monthly POA&M updates, vulnerability and patch reporting, IAVM compliance, significant change reviews, periodic assessments—and push findings to closure with engineering.
• Validate STIG compliance and analyze vulnerability scan results from ACAS/Tenable Nessus, tracking remediation against NIST 800-53 and DoD requirements.
• Serve as technical point of contact for ISSMs, assessors, and Authorizing Officials during assessments, readiness reviews, and audits.
• Partner with Product and Engineering to map cloud-native controls—AWS, containers, Kubernetes, CI/CD pipelines—to DoD RMF and NIST 800-53 requirements with defensible evidence.

What You Bring

• 3–5 years hands-on DoD cybersecurity, RMF authorization, or information assurance experience, with direct ISSO or equivalent compliance role supporting DoD ATO packages.
• Demonstrated proficiency building and maintaining authorization packages in eMASS.
• Working knowledge of DISA PPSM registration, ports, protocols, services process, CAL, and boundary/data-flow documentation.
• Strong practical knowledge of NIST 800-53 (Rev 4/5), NIST 800-37 RMF, and DoD-specific implementation guidance.
• Familiarity with DoD tools and policies governing authorizations: DISA STIGs, STIG Viewer/SCC, ACAS, IAVM, DISA Cloud Computing SRG, and continuous monitoring standards.
• Solid understanding of modern cloud environments (AWS, containers, Kubernetes, CI/CD) and how cloud-native patterns map to technical security controls.
• Strong written communication skills to produce assessor-ready documentation and clear control narratives.
• Active U.S. Secret security clearance required; DoD 8570/8140 IAM Level I or IAT Level II baseline certification (Security+, CISSP, or equivalent) required or obtainable within 90 days.
• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $150,000 and $170,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

Perks of Joining Our Team

• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Visit our careers page to learn more.

Who We Are

The company (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com [link for members]

Citizenship requirement

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team?

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices

Colorado

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.