Mid-Level Information System Security Officer, ISSO
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
ISSO owning cybersecurity posture and RMF compliance for systems supporting a large federal agency. Leading assessments, continuous monitoring, POA&M remediation, and authorization readiness.
Responsibilities:
- Own the security posture for assigned systems
- Advise on architecture, authorization boundaries, and risk decisions
- Lead control compliance and assessment readiness
- Maintain the System Security Plan and other key security artifacts
- Coordinate audits and assessments, including scheduling, evidence readiness, and responses to assessor findings
- Run continuous monitoring and reporting
- Define security metrics and escalate material risks and issues
- Drive vulnerability remediation and POA&M corrective actions, including exceptions, compensating controls, and risk acceptances
- Execute Risk Management Framework tasks across categorization, control selection, implementation, assessment, and authorization in accordance with NIST SP 800-37
- Support transition to and management of an Ongoing Authorization program
- Provide cybersecurity guidance to Business Owners and System Owners
- Liaise between stakeholders and cybersecurity staff
- Support System Owner system access reviews and account management compliance
- Apply automation and AI tooling to streamline RMF documentation, control assessments, and continuous monitoring activities
Requirements:
- Bachelor's degree in cybersecurity, information technology, or a related field
- 4 years of ISSO experience, including ownership of security posture for one or more systems
- Demonstrated experience maintaining SSPs and leading a system through assessment or authorization
- Hands-on experience managing POA&Ms, including exceptions, compensating controls, and risk acceptances
- Working knowledge of NIST SP 800-37, NIST SP 800-53, and continuous monitoring practices
- Experience advising system owners or engineering teams on risk decisions
- U.S. Citizenship or Permanent Residency
- All work must be performed within the continental U.S.
- Ability to pass a federal agency suitability or background investigation
- Prior federal contracting experience as an ISSO at a civilian agency preferred
- Experience with Ongoing Authorization or continuous ATO programs preferred
- Experience with a GRC platform such as Xacta, eMASS, CSAM, Archer, or ServiceNow IRM preferred
- Cloud authorization experience, including FedRAMP inheritance and interconnection agreements preferred
- Experience defining security metrics and reporting posture to non-technical stakeholders preferred
- Certifications such as CISSP, CGRC, CISM, or CCSP preferred
- Clear written and verbal communication with technical and non-technical audiences
- Ability to work independently and as a contributing member of a distributed team
- Comfort operating in a fully remote setting with a camera-on meeting culture
- Sound judgment about when to decide and when to escalate
- Collaborative posture with system owners, business owners, developers, and assessors
- Attention to documentation quality and follow-through on commitments
Benefits:
- Multiple POS health plan options including an HSA-compatible plan
- Dental PPO coverage for preventive, basic, and major services
- Vision coverage including annual exam, frames, lenses, and contact lens allowance
- 401(k) employer match up to 5% of eligible compensation
- 100% employer-paid long-term disability coverage at 50% of pre-disability earnings
- 100% employer-paid life insurance and AD&D coverage valued at $10,000 each
- 15–25 days of PTO annually based on tenure
- Paid observance of all 11 federal holidays
Similar Jobs
Regional Security Manager
Regional Security Manager protecting Saab’s defence and security operations across Southern Africa. Coordinating personnel, risk, compliance, crisis response and regional security strategy.
Principal Security Architect
Principal Security Architect owning cloud and application security for Lilly’s AWS-heavy strategic programs. Protecting trade secrets through architecture reviews, threat modeling, and risk governance.
Senior Security Architect
Senior Security Architect designing scalable cybersecurity solutions for Humana’s healthcare insurance and CenterWell services. Supporting cloud, application, risk, compliance, automation, and acquisition integration initiatives.
Managing Engineer – Data Security Engineering
Managing Engineer leading Allstate’s data security engineering team. Building automated DLP, data intelligence, and data access controls for insurance operations.
SAP Security Consultant – AMS
SAP Security Consultant administering roles, authorizations, and access governance for DyFlex clients. Supporting audits, SoD analysis, GRC, upgrades, and managed SAP environments.
Senior Security Engineer, Customer Transparency
Senior Security Engineer improving customer transparency for Tanium’s AI-powered endpoint management and security platform. Managing vulnerability disclosure, SBOM visibility, bug bounty operations, and security advisories.
Técnico/a de Seguridad, PAM – CyberArk
Técnico/a PAM CyberArk administrando cuentas privilegiadas, credenciales y Safes. Soporte de servicios gestionados de ciberseguridad para un cliente financiero de Logicalis Spain.
Domain Lead – Transformation, Cybersecurity Strategy Adoption
Cybersecurity transformation lead embedding policies, change management, and security adoption across SNCB/NMBS. Driving workforce engagement and governance for Belgium’s national railway.
Senior IT Systems, Security Engineer
Senior engineer implementing secure identity, endpoint, cloud, and network systems for Defense Unicorns’ federal and enterprise customers. Supporting compliance-ready software delivery and cybersecurity operations.
IT Systems, Security Engineer
IT Systems & Security Engineer implementing and securing customer IT environments for Defense Unicorns. Configuring identity, endpoints, networks, compliance controls, and automation.
Senior Security Engineer
Senior Security Engineer securing Redox’s cloud-native healthcare data interoperability platform. Hardening Kubernetes, containers, infrastructure, and application security across U.S.-based remote engineering teams.
Cyber Security Engineer
Cyber Security Engineer protecting HBK’s global enterprise IT environment. Securing cloud, network, endpoint, identity, and AI systems for a global test and measurement leader.
Senior Information Systems Security Engineer
Senior ISSE authorizing Navy cybersecurity systems for Leidos' enterprise IT program. Managing RMF, ATO packages, STIGs, vulnerability compliance, and DoD security documentation.
Security Engineer
Security Engineer leading advanced penetration testing and agentic AI workflows for Cisco’s cloud and on-premises products. Identifying vulnerabilities and guiding remediation to strengthen global customer security.
Senior Cloud Security Engineer
Senior Cloud Security Engineer securing complex client Azure environments. Leading cloud security architecture, incident response, IAM, compliance, and automation initiatives.
Cybersecurity Engineer
Cybersecurity Engineer securing Business Wire’s applications, cloud, and IT systems. Integrating security testing, vulnerability management, incident response, and security awareness practices.
Senior Product Security Engineer
Senior Product Security Engineer securing Staffbase’s AI-native employee experience platform. Improving security automation, Kubernetes and CI/CD security, and vulnerability detection.
Senior Penetration Testing Analyst
Senior penetration tester conducting application or network security assessments for Sophos, a cybersecurity provider. Leading client readiness, exploitation testing, reporting, and remediation discussions.
SAP Security Consultant – Contract
SAP Security Consultant designing and delivering ECC, S/4HANA, Fiori, BTP, and GRC security solutions. Supporting SAP implementations and operations for leading Australian enterprises.
Senior Security Engineer
Senior Security Engineer hardening beverage-industry technology platforms across VIP’s U.S. operations. Leading segmentation, detection, vulnerability, identity, and incident-response engineering.