Information Systems Security Officer (ISSO)

Responsibilities

• ● Job Overview
• ● Job Title: Information Systems Security Officer (ISSO)
• ● Job Location: Al Nakhla, Saudi Arabia
• ● Job Responsibilities
• ● Trace Systems is seeking an experienced Information Systems Security Officer (ISSO) to support the USMTM CITS contract in Riyadh, Kingdom of Saudi Arabia. The ISSO supports cybersecurity posture, authorization, continuous monitoring, vulnerability management, incident response, security-control implementation, audit readiness, and compliance for mission-critical classified and unclassified systems.
• ● Support implementation and sustainment of the Department of Defense Risk Management Framework for assigned systems and network enclaves.
• ● Develop, review, and maintain System Security Plans, control implementation statements, system descriptions, contingency and incident response plans, and authorization artifacts.
• ● Support initial and recurring authorization activities required to obtain and maintain Authority to Operate status.
• ● Maintain Plans of Action and Milestones, track remediation, validate closure evidence, and coordinate disposition of cybersecurity findings.
• ● Prepare Security Assessment Reports, risk assessments, control-assessment evidence, and continuous-monitoring documentation.
• ● Coordinate with Government IAM, ISSM, authorizing officials, assessors, cybersecurity service providers, and higher-level organizations.
• ● Perform security-impact analyses and provide cybersecurity recommendations through Configuration Control Board processes.
• ● Monitor security posture using approved vulnerability, compliance, endpoint-security, logging, and scanning tools.
• ● Review scan results, security bulletins, IAVAs, directives, and notifications; prioritize and coordinate remediation with technical teams.
• ● Verify implementation of STIGs, security baselines, patches, mitigations, logging, access controls, and corrective actions.
• ● Support incident triage, reporting, investigation, containment, eradication, recovery, notifications, and after-action activities.
• ● Review system, application, audit, and security logs for anomalies, unauthorized activity, or indicators of compromise.
• ● Support account management, privileged access, PKI, token, password, identity lifecycle, certificates, and SIPR credential processes when authorized.
• ● Support security testing, inspections, audits, assessments, metrics, briefings, awareness, role-based training, and continuity documentation.
• ● Provide cybersecurity guidance that balances compliance, mission availability, operational risk, and technical requirements.