EdgeByte

About the Role

EdgeByte is seeking an Information System Security Officer (ISSO) to support cybersecurity governance, risk management, compliance, vulnerability management, and system authorization activities across enterprise, cloud, and hybrid environments.

The ISSO will work closely with system owners, engineers, cybersecurity teams, program leadership, and customer stakeholders to implement and maintain security controls, assess system risk, track vulnerabilities and remediation activities, maintain security documentation, and support continuous monitoring throughout the system lifecycle.

This role may support commercial, regulated, federal, defense, and other public-sector environments and requires the ability to translate cybersecurity requirements into actionable technical and operational controls while maintaining accurate evidence and compliance documentation.

Reponsibilities:

Support implementation, assessment, and ongoing maintenance of cybersecurity controls across enterprise, cloud, and hybrid information systems.

Maintain system security documentation including System Security Plans, security procedures, control implementation statements, risk assessments, and supporting evidence.

Support Risk Management Framework activities throughout system categorization, control implementation, assessment, authorization, and continuous monitoring.

Track cybersecurity findings, vulnerabilities, weaknesses, risks, and remediation activities through Plans of Action and Milestones or comparable risk-tracking processes.

Review vulnerability scan results, configuration assessments, penetration testing findings, and security alerts and coordinate remediation with technical teams.

Support vulnerability management activities using tools such as Tenable, Qualys, Defender Vulnerability Management, or comparable platforms.

Coordinate with cloud, networking, ICAM, infrastructure, application, DevOps, and cybersecurity engineers to validate security-control implementation.

Support security control assessments, audits, authorization activities, compliance reviews, and evidence collection.

Monitor system changes and evaluate potential security impacts to approved architectures, configurations, and authorization boundaries.

Review account management, privileged access, logging, encryption, network segmentation, configuration management, and other security-control implementations.

Support secure configuration and hardening efforts using applicable benchmarks, baselines, STIGs, CIS guidance, or organizational security standards.

Maintain inventories of systems, applications, interfaces, components, software, and security-relevant assets where required.

Support incident response coordination, security investigations, and reporting activities as required.

Track continuous-monitoring requirements, recurring assessments, security metrics, control evidence, and remediation status.

Identify cybersecurity risks and communicate technical findings, impacts, recommendations, and remediation priorities to technical and program stakeholders.

Assist with development and maintenance of cybersecurity policies, procedures, standards, runbooks, and governance documentation.

Required Qualifications:

CompTIA Security+

5+ years of cybersecurity, information assurance, information security, GRC, system administration, cloud, infrastructure, or related IT experience.

3+ years of hands-on experience supporting information-system security, compliance, RMF, security controls, or vulnerability-management activities.

Strong understanding of cybersecurity risk management, security controls, continuous monitoring, vulnerability management, and remediation processes.

Experience developing or maintaining System Security Plans, security-control documentation, risk assessments, POA&Ms, control evidence, or comparable compliance artifacts.

Working knowledge of NIST 800-53, NIST Risk Management Framework, NIST Cybersecurity Framework, or comparable security-control frameworks.

Experience reviewing vulnerability scans, security findings, configuration weaknesses, and remediation activities.

Experience working with vulnerability-management tools such as Tenable, Qualys, Microsoft Defender, Rapid7, or comparable platforms.

Understanding of identity and access management, privileged access, network security, logging, encryption, configuration management, and system-hardening principles.

Ability to evaluate technical implementations against cybersecurity and compliance requirements.

Experience supporting security assessments, audits, continuous monitoring, evidence collection, or authorization activities.

Ability to communicate security risks, findings, remediation requirements, and technical recommendations to engineering and program stakeholders.

Strong technical documentation, organizational, analytical, and communication skills.

U.S. work authorization and ability to satisfy customer-specific access requirements.

Preferred Qualifications:

ISC2 Certified in Governance, Risk and Compliance (CGRC), CISSP, CISM, CASP+/SecurityX, or comparable cybersecurity certification.

Experience supporting NIST 800-53 Rev. 5, Risk Management Framework, FedRAMP, CMMC, FISMA, or comparable regulated security programs.

Experience supporting Authority to Operate, Authorization to Operate, system authorization, assessment and authorization, or comparable compliance processes.

Experience developing and maintaining SSPs, POA&Ms, Security Assessment Reports, control implementation statements, continuous-monitoring plans, and authorization packages.

Experience with DISA STIGs, Security Technical Implementation Guides, SCAP tools, CIS Benchmarks, or secure-configuration baselines.

Experience with Tenable Security Center, Nessus, Qualys, Defender for Cloud, Microsoft Sentinel, Splunk, or comparable security platforms.

Experience supporting Microsoft Azure, AWS, hybrid-cloud, or enterprise infrastructure environments.

Experience reviewing cloud security posture, identity configurations, network controls, logging, encryption, vulnerability findings, and security baselines.

Experience supporting incident response, audit remediation, risk acceptance, exception management, and cybersecurity governance processes.

Knowledge of Zero Trust, NIST 800-207, FedRAMP, CMMC, ISO 27001, SOC 2, HIPAA, PCI DSS, or similar cybersecurity and compliance frameworks.

Experience supporting commercial, regulated, federal, defense, healthcare, financial, critical-infrastructure, or other security-sensitive environments.

POSITION DETAILS