Junior Information System Security Officer (Remote)

About the role

Dragonfli Group is seeking a Junior Information System Security Officer to support a federal cybersecurity team. This entry‑level position works remotely within the continental United States and assists senior ISSOs in maintaining system authorizations under the NIST Risk Management Framework.

Key responsibilities

• Support RMF lifecycle activities for assigned federal information systems, including categorization, control implementation, assessment, and continuous monitoring.
• Develop and update system security documentation such as System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Track and document security control deviations, vulnerabilities, and remediation through to closure.
• Assist with continuous monitoring tasks, including log review and vulnerability scan analysis.
• Maintain system inventory, hardware/software baselines, and interconnection agreements.
• Support incident response documentation, escalation tracking, and remediation follow‑up.
• Participate in security reviews, audits, and inspections alongside the broader team.
• Coordinate routine compliance tasks with Information System Owners and other stakeholders.

Required profile

• 0–2 years of experience in IT, cybersecurity, information assurance, or a related military/government role.
• Working knowledge of the NIST Risk Management Framework (RMF) and NIST SP 800‑53 security controls, obtained through training, coursework, or certification study.
• U.S. citizenship (or permanent residency) and ability to pass a Public Trust background investigation.
• Ability to work remotely during core business hours (9 am–5 pm ET) and collaborate with the team.
• Strong written communication skills.

Required skills

• NIST Risk Management Framework (RMF)
• NIST SP 800‑53 security controls
• System Security Plan (SSP) documentation
• Security Assessment Report (SAR) preparation
• Plans of Action and Milestones (POA&M) management
• Log review and vulnerability scanning
• Incident response documentation