Information Systems Security Officer

Responsibilities

Support and execute all phases of the NIST SP 800-37 RMF lifecycle including categorization, control selection, implementation, assessment, authorization, and continuous monitoring across multiple concurrent systems and network environments
Develop, maintain, and update RMF documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Security Assessment Plans (SAPs), POA&Ms, Contingency Plans, Incident Response Plans, Risk Assessment documentation, and interconnection agreements
Conduct multiple concurrent RMF assessments simultaneously, maintaining compliance documentation in JCAM
Assess and authorize emerging technology systems — including AI/ML platforms and microservices-based architectures — adapting NIST SP 800-53 Rev 5 control baselines to novel system types where standard guidance requires augmentation
Manage evidence collection, control traceability documentation, and Body of Evidence (BOE) packages for assessments, audits, and compliance reviews
Establish system impact levels following FIPS 199 for confidentiality, integrity, and availability; conduct and document Privacy Impact Assessments (PIAs) and Privacy Threshold Analyses (PTAs)
Review and analyze vulnerability results using Tenable Security Center; create, track, and manage POA&M remediation activities through closure; validate scan completeness before Security Control Assessor review
Provide security reporting, dashboards, and status updates to system owners and stakeholders; support development and maintenance of security metrics and scorecard reporting
Ensure systems comply with FISMA, NIST SP 800-53 Rev 5, CNSSI 1253, OMB A-130, and applicable client cybersecurity policies
Manage assessment workflow and task tracking using JIRA; maintain accurate status visibility across multiple concurrent assessment pipelines
Mentor junior ISSO staff; develop SOPs, work instructions, and process documentation to improve team efficiency and assessment quality
Collaborate with technical and non-technical personnel to review systems, gather evidence, and communicate security requirements to system owners and program leadership

Qualifications

Bachelor's with 12+ years of information system security experience (or commensurate experience)
8–10+ years in an ISSO or cybersecurity compliance role, with direct responsibility as ISSO of record on assigned systems
Demonstrated experience conducting RMF assessments across multiple network environments
Experience managing multiple concurrent A&A assessments simultaneously
Experience developing and maintaining complete RMF artifact packages: SSPs, SARs, POA&Ms, RAR, and supporting BOE documentation
Experience with microservices-based or distributed system architectures and component-level security assessments
Proficiency with GRC platforms for A&A documentation and continuous monitoring (JCAM/CSAM, Xacta, or equivalent)
Active CompTIA Security+ CE certification
DoD 8570.01-M / DoD 8140 compliant — IAM Level II or III (CISSP, CISM, CASP+, or equivalent)
Clearance Required: Ability to maintain a Public Trust clearance