Information Systems Security Officer (ISSO) (R-00047)

The Information Systems Security Officer (ISSO) at True Zero Technologies is responsible for maintaining the overall security posture of assigned information systems. This includes managing day-to-day security operations, developing and reviewing security documentation, performing vulnerability and risk assessments, and ensuring compliance with security policies and industry standards such as the National Institute of Standards and Technology Risk Management Framework.

To be considered for the Information Systems Security Officer position at True Zero Technologies, candidates should have a BA or BS degree in Computer Science or a related field, or at least four years of relevant experience. Additionally, candidates should possess strong communication skills, experience with Federal DevSecOps frameworks, and knowledge of IT security principles such as firewalls and encryption.

True Zero Technologies supports its ISSO employees by investing in training and certifications that help broaden and deepen their technical skills. This commitment to professional growth, combined with competitive salary packages and a supportive workplace culture, makes True Zero an exceptional place to advance your career in cybersecurity.

An ISSO at True Zero Technologies should be familiar with various security frameworks, especially the National Institute of Standards and Technology Risk Management Framework (NIST RMF), NIST SP 800-53, and Security Technical Implementation Guides (STIGs). Knowledge of the security assessment process and the preparation of System Security Plans (SSPs) to achieve Authority to Operate (ATO) objectives is also crucial.

ISSO employees at True Zero Technologies can expect a range of benefits, including competitive salaries, comprehensive medical coverage (with 100% of premiums covered), generous PTO and paid holidays, a 401k program with 100% company match, and reimbursement for cell phone and home internet costs. Additionally, the company fosters a nurturing environment for work-life balance and family support.

When discussing your experience with the Risk Management Framework, be specific about the projects you've worked on that involve RMF. Explain how you contributed to various stages of the RMF process, such as categorization, selection of security controls, implementation, assessment, authorization, and continuous monitoring.

In your answer, outline a clear step-by-step process for conducting vulnerability assessments. Discuss how you identify assets, use automated tools, interpret results, prioritize vulnerabilities, and communicate findings to stakeholders, ensuring a thorough approach to security management.

Discuss your strategy for ensuring compliance, which may include regular audits, documentation reviews, employee training, and collaboration with other teams. Mention tools or methodologies you’ve used to maintain adherence to security standards.

Highlight key security controls such as access controls, encryption, firewalls, and intrusion detection systems. Explain why these controls are critical for protecting information systems and how you have implemented them in past roles.

Describe a systematic incident response process. Discuss detection, containment, eradication, recovery, and lessons learned, emphasizing the importance of a coordinated team response and effective communication during security incidents.

Provide examples of real challenges you've encountered, such as budget constraints, evolving threats, or compliance requirements. Discuss the strategies you implemented to successfully navigate these challenges and the outcomes achieved.

Explain your methods for staying informed, such as attending conferences, participating in webinars, following industry news outlets, or engaging with professional organizations. Discuss how this knowledge influences your work.

Be specific about the cybersecurity tools you’ve worked with, such as SIEM, endpoint protection platforms, or vulnerability assessment scanners. Share how you leveraged these tools to enhance security and achieve compliance.

Discuss your approach to simplifying complex security concepts for non-technical audiences by using clear language and relatable examples. Include your techniques for addressing concerns, fostering collaboration, and obtaining buy-in for security initiatives.

Share your insight on current risks, such as phishing attacks, insider threats, or supply chain vulnerabilities. Explain how these risks impact organizations and how you have mitigated similar risks in your previous roles.