Information system security officers recruiting
An information system security officer is responsible for the security posture of a system: the authorization package, the controls and their evidence, continuous monitoring, incident reporting and the plan of action and milestones that keeps the authorization current.
The information system security manager oversees a program's ISSOs. Recruiters Workforce recruits both for defense contractors, intelligence programs, civilian agencies and the subcontractors preparing for Cybersecurity Maturity Model Certification assessments.
What information system security officers do
The ISSO maintains the system security plan, coordinates control assessments, tracks vulnerabilities and remediation, manages user access and privileged accounts, reports incidents through the program's channels, and works with the authorizing official's staff to obtain and keep the authorization to operate under the Risk Management Framework. On defense programs the ISSO also supports the facility security officer on classified information systems. On subcontractor programs preparing for CMMC, the ISSO owns the NIST SP 800-171 assessment and its evidence.
Requisitions name the framework and the assessment tools the program uses, the number of systems the ISSO will carry, and whether the role sits inside a classified environment. They increasingly name the CMMC level, because the DFARS rule at 252.204-7021 took effect on November 10, 2025 and contracting officers may not award to an offeror without the required CMMC status.
Certifications commonly requested
ISSO requisitions ask for governance and security management credentials, and the issuing bodies publish these requirements.
- CompTIA Security+
- The baseline credential named on most Department of Defense ISSO requisitions. Current version V7; V8 expected on or around November 17, 2026.
- ISC2 CGRC
- ISC2's governance, risk and compliance certification requires a minimum of two years of cumulative, full-time experience in one or more of its seven domains, which run from security and privacy governance and risk management through control selection, implementation, assessment, system compliance and compliance maintenance.
- ISC2 CISSP
- Requires five years of cumulative, full-time experience in two or more of the eight domains, with a related degree or approved credential satisfying up to one year. Requested for ISSMs and senior ISSOs.
- ISACA CISM
- Certified Information Security Manager requires a minimum of five years of professional information security management work experience gained within the ten years before applying. Requested for ISSMs.
- ISACA CISA
- Certified Information Systems Auditor requires a minimum of five years of information systems auditing, control or security work experience within the ten years before applying. Requested where the ISSO also performs assessments.
- CompTIA SecurityX
- CompTIA's advanced certification for security architects and senior security engineers; the current exam is CAS-005, launched December 17, 2024. Requested for senior ISSOs on engineering-heavy programs.
Clearance levels commonly required
Because the ISSO carries the authorization for a system, the position requires the system's clearance: Secret or Top Secret on defense programs and TS/SCI on intelligence programs. Civilian agency ISSO positions are high-risk Public Trust. Subcontractors preparing for CMMC often hire a non-cleared ISSO for the NIST SP 800-171 work, since no clearance is needed to implement or assess those 110 requirements.
Engagement models that fit
Direct hire is the most common model, because a program wants its ISSO on the contractor's own payroll for the life of the authorization. Contract-to-hire fits programs that expect headcount on award, and contract staffing fits assessment surges before a CMMC or authorization deadline. Retained search fits ISSMs on large programs. The engagement models page compares them.
Industries that hire information system security officers
Markets where information system security officers are in demand
Questions about recruiting information system security officers
What does a CMMC assessment mean for an ISSO requisition?
Under 32 CFR Part 170, CMMC Level 2 is the 110 security requirements of NIST SP 800-171 Revision 2, and the DFARS clause requires a current CMMC status at the level the solicitation names. A subcontractor's ISSO owns the implementation and the evidence, so the requisition should state the level, the number of systems in scope and the assessment date, because those facts decide how senior the candidate must be.
Can an ISSO position be filled by a security analyst without ISSO experience?
Sometimes, on a program with an experienced ISSM and a single low-impact system. On programs carrying several systems through the Risk Management Framework, employers want candidates who have taken a system through an authorization and kept it, and the submittal records that history system by system.