ISSO 5

Position Location:

This position is located in Los Alamos, New Mexico.

Los Alamos is a tight-knit mountain community that consistently ranks as one of Livability.com's Best Small Towns in America. For two years in a row, Los Alamos County has ranked as the healthiest county in the nation according to a U.S. News report. The city is a top spot for outdoor enthusiasts as it has more than 120 hiking and biking trails, and residents enjoy easy access to the Pajarito Mountain Ski Area. Thanks to the University of New Mexico-Los Alamos' presence in the area, Los Alamos also has a college-town vibe that's a major draw for young professionals, families and retirees.

Position Summary

The Information Systems Security Officer (ISSO) Lead / Alternate Information System Security Manager (AISSM) provides seniorlevel cybersecurity oversight and technical support across assigned information systems to ensure compliance with Department of Energy (DOE), National Nuclear Security Administration (NNSA), federal, and N3B cybersecurity requirements. This position leads to execution of system authorization activities, continuous monitoring, vulnerability management, and mentorship of ISSO staff. The role advises and shares ownership/authorship of System Security Plans (SSPs), Security Assessment Reports (SARs), Assessment & Authorization (A&A) packages, control narratives, and other administrative RMF documents. The ISSO Lead also serves as the Alternate Information System Security Manager (AISSM), covering ISSM responsibilities during periods of absence, major escalations, or elevated operational needs.

Essential Duties/Responsibilities (may include, but are not limited to):

• Serve as Lead ISSO across assigned General Support Systems (GSS), Major Applications (MA), Industrial Control Systems (ICS), and specialty systems.
• Support the ISSM by ensuring operational continuity during escalated or delegated ISSM activities, including systemsecurity leadership, coordination of staff, and implementation of DOE/NNSA cybersecurity mandates.
• Provide mentorship and skill development for ISSO, ISSE, and Risk Analyst staff.
• Lead development and maintenance of all Assessment & Authorization (A&A) documentation, including SSPs, SARs, Configuration Management Plans (CMPs), Contingency Plans (CPs), Incident Response Plans (IRPs), and Risk Assessment (RA) artifacts.
• Support ISSM and ISSO in preparation, review, and timely submission of Regulatory Documentation (RegDocs) deliverables, Plan of Action & Milestones (POA&M) updates, and Authorization to Operate (ATO) packages.
• Ensure documentation is consistent with Los Alamos Legacy Cleanup Contract (LLCC) governance expectations.
• Oversee implementation, testing, and verification of NIST SP 80053 controls across assigned systems.
• Conduct vulnerability management, log review, control testing, and evidence collection.
• Elevate critical findings to ISSM, Cybersecurity Manager, and Chief Information Security Officer (CISO), and coordinate mitigations.
• Lead risk assessments for cybersecurity findings, system changes, new capabilities, and emerging DOE directives.
• Support ISSM, Cybersecurity Manager, and CISO in enterprise risk reporting, compliance tracking, and implementation of organizational governance processes.
• Facilitate peer reviews, POA&M / PerformanceBased Incentive (PBI) contributions, and readiness for DOE assessments.
• Engage system owners, Subject Matter Experts (SMEs), and technical stakeholders to ensure cybersecurity expectations are clearly understood and implemented.
• Provide the ISSM with situational updates on risk posture, compliance status, and emerging issues requiring managerlevel attention.
• Support crossfunctional collaboration with Cyber Engineering, ICS security, Governance, Risk & Compliance (GRC), and enterprise monitoring teams.
• Operational Backup: Ensure continuity of cybersecurity operations when ISSM responsibilities are delegated.
• Program Oversight: Support leadership in reviewing system posture, data calls, document tracking, ATO milestone tracking, and DOE submissions.
• Staff Coordination: Help balance workloads across ISSO 4-5 staff, ISSE personnel, and Risk Analysts.
• Escalation Support: Provide timely and accurate analysis for issues requiring AISSM review, including major vulnerabilities, incidents, or compliance risks.
• CrossSite Alignment: Support ISSM during coordination with EMLA, EMHQ, or other DOE/NNSA entities.

Minimum Qualifications (Knowledge, Skills, Abilities):

• Excellent interpersonal skills: written and verbal communication, effective listening, conflict resolution
• Extensive experience as an ISSO, cybersecurity analyst, or security engineer within DOE/NNSA environments.
• Deep knowledge of the NIST Risk Management Framework (RMF), NIST SP 80053, and A&A processes.
• Deep working knowledge of NIST SP 800series publications (specifically 80037, 80053, and 800137)
• Strong proficiency in cybersecurity toolsets (logging, endpoint protection, vulnerability management).
• Demonstrated capability to support elevated security leadership roles, including AISSM or ISSM support functions.
• Familiarity with security tools such as Tenable (Nessus, Security Center), Splunk, SCAP Tool, STIG Viewer
• Familiarity with federal IT compliance structures (e.g., FISMA, DOE Order 205.1C/D, FedRAMP)
• Experience using federal GRC tools (e.g., XACTA, eMASS, Archer, RegScale) to manage risk packages
• Related certifications including CISSP, CISM, CASP, Security+, CHFI, CEH
• Must be able to maintain confidentiality when working with sensitive information.
• All qualified applicants will be considered; however, the successful candidate must be able to obtain and maintain a Q clearance from the United States Department of Energy.

• Cybersecurity Leadership
• RiskBased Decision Making
• Regulatory Documentation Rigor
• Team Mentorship
• CrossFunctional Collaboration
• Situational Awareness & Escalation Judgment

Education and Experience Required:

Bachelor's degree with twelve (12) years of experience or a Master's degree with ten (10) years of experience. A combination of education and relevant experience wherein the knowledge, skills and abilities to perform the position's duties and responsibilities have been adequately demonstrated is acceptable.

• Experience with N3B/LLCC system portfolios and organizational structures.
• Prior involvement in POA&M/ATO submission cycles and DOE reporting.
• Experience supporting ICS/Operational Technology (OT) systems and enterprise monitoring platforms.

Experience required for all levels:

• Technical Familiarity for Risk Assessment: working knowledge of security controls, audit logs, and risk implications associated with enterprise systems.
• Enterprise Infrastructure: Windows/Linux operating systems, Active Directory, and Group Policy Objects (GPOs).
• Security Operations & Engineering: SIEM platforms, Network Intrusion Detection Systems (IDS), hostbased antivirus consoles, and Data Loss Prevention (DLP) solutions.
• Technical Assessments: review/translation of outputs from advanced cybersecurity tools, vulnerability scanners, penetration tests, malware analysis, and digital forensics into actionable risk decisions.

Education Equivalency: 1 years of relevant experience for 1 year of college.

Benefits and Salary:

N3B offers all full-time employees a comprehensive benefits package that includes 401(k) with employer matching, medical, dental, vision, paid PTO, and more. Starting salary will be commensurate with experience and education.

Business Associations:

Servs as prime consultant and external spokesperson for the organization on highly significant matters relating to policies, programs, capabilities, and long-range goals and objectives.

Impact:

Decisions affect the financial, employee, or public relations posture of the organization. Erroneous decisions or recommendations would normally results in failure to achieve goas critical to the major objectives of the organization.

Working Conditions and Physical Requirements:

Sedentary Work Category - The employee exerts up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push pull or otherwise move objects, including the human body. While performing the duties of this job, the employee is regularly required to talk or hear. The employee is frequently required to stand, walk, sit, use hands to touch or feel, and reach with hands and arms. The employee is occasionally required to stoop, kneel, crouch, or crawl. Specific vision abilities required by this job include close vision and distance vision. The noise level in the work environment is usually quiet to moderate. This job description reflects management's assignment of essential functions; and nothing in this herein restricts management's right to assign or reassign duties and responsibilities to this job at any time.

Safety, Security, and Quality

While working to achieve N3B LLCC objectives, the Information Systems Security Officer (ISSO) will ensure all activities and operations are performed in a safe and deliberate manner to include protecting the confidentiality and integrity of Personally Identifiable Information (PII). This role will maintain required safety, security and operational training; assure procedural and regulatory compliance; and make safety, security and quality an integral part of every task; including taking the necessary steps to stop work if continuing the job is unsafe or compromises security.

Equal Opportunities

N3B is an equal opportunity employer. N3B will ensure no applicant for employment or employee is denied equal opportunity because of race, color, religion, sex, gender identity, sexual orientation, pregnancy, status as a parent, national origin, age, disability (physical or mental), family medical history or genetic information, political affiliation, military service, or other non-merit based factors. These protections extend to all management practices and decisions, including recruitment and hiring practices, appraisal systems, promotions, training, and career development programs.