Information Systems Security Officer (ISSO) – Mid/Senior Level

Accountabilities: Security Assessment and Authorization: Lead the preparation, development, and maintenance of ATO documentation, including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and supporting security documentation. Risk Management Framework: Guide assigned information systems through the complete ATO lifecycle and continuous authorization processes, ensuring compliance with NIST SP 800-53, FISMA, FedRAMP, and RMF requirements. Risk Assessment and Mitigation: Conduct Security Impact Analyses (SIAs) for system changes, identify security risks, develop remediation strategies, and collaborate with system engineers to maintain secure system configurations and baselines. Compliance and Security Assessments: Perform security self-assessments, risk assessments, and periodic compliance reviews to verify the effectiveness of implemented security controls. Contingency and Incident Response: Coordinate and support annual testing of Contingency Plans and Incident Response Plans to ensure organizational readiness and regulatory compliance. Continuous Monitoring: Review audit logs, analyze vulnerability scan results, and evaluate system-level security reports to identify weaknesses and maintain ongoing security assurance. Technical Security Oversight: Apply knowledge of network security, operating systems, cloud environments, container technologies, and security assessment tools to evaluate and strengthen system security. Multi-System Management: Oversee the security posture and compliance activities of approximately four to six information systems simultaneously. Stakeholder Collaboration: Serve as a trusted security advisor, communicating security findings, compliance requirements, and remediation recommendations clearly to clients and technical teams. Documentation and Reporting: Maintain accurate security records, track remediation activities, and ensure all authorization and compliance documentation remains current and audit-ready. Requirements Bachelor's degree in Information Technology, Cybersecurity, or a related discipline. At least 6 years of hands-on professional experience in Information Systems Security Officer (ISSO) or Risk Management Framework (RMF) roles. Direct experience developing and managing federal ATO documentation, including SSPs, POA&Ms, and SARs. Strong working knowledge of NIST SP 800-53, FISMA, FedRAMP, and Risk Management Framework requirements. Demonstrated experience managing the security and compliance activities of multiple information systems, ideally four to six systems concurrently. Practical knowledge of security assessments, vulnerability management, continuous monitoring, security control implementation, and risk mitigation. Technical understanding of network security, cloud architectures, operating systems, containers, and cybersecurity assessment tools. Relevant professional certification required, such as CISSP, CISM, CISA, CRISC, or CGRC. Experience supporting federal civilian agencies is highly desirable. Familiarity with cloud service environments, including SaaS, IaaS, and PaaS, particularly AWS, Microsoft Azure, or Google Cloud Platform. Experience with Archer or CSAM security and compliance platforms is an advantage. Proficiency with Google Workspace tools and familiarity with AI-powered productivity tools such as Gemini or ChatGPT. Active Public Trust clearance is preferred. Strong analytical, organizational, and problem-solving abilities, with exceptional attention to detail. Excellent written and verbal communication skills, including the ability to explain complex security concepts to technical and non-technical stakeholders. Ability to work independently, manage competing priorities, and demonstrate initiative in a fully remote environment. Must be authorized to work in the United States without sponsorship and successfully complete a federal background investigation, including financial suitability screening. Veterans, transitioning service members, and military-affiliated professionals are strongly encouraged to apply. Benefits Remote work: Fully remote position, offering flexibility to work from anywhere within the United States. Career development: Opportunity to contribute to important federal cybersecurity programs and strengthen expertise in security compliance and risk management. Professional growth: Exposure to federal security frameworks, complex information systems, and enterprise cloud environments. Meaningful impact: Opportunity to support the protection and security of critical government information systems. Inclusive environment: Commitment to recognizing military experience and encouraging applications from veterans and transitioning service members.