Information System Security Officer (ISSO)

Job Responsibilities

• Support assigned information systems through all phases of the Risk Management Framework (RMF) lifecycle.
• Maintain System Security Plans (SSPs), security documentation, and authorization artifacts to accurately reflect the operational environment.
• Coordinate with System Owners to ensure security requirements are incorporated into system operations and lifecycle activities.
• Collect, organize, and validate evidence supporting security control implementation and continuous monitoring activities.
• Track vulnerabilities, POA&Ms, remediation activities, risk acceptance decisions, and corrective actions to ensure timely resolution and accurate documentation.
• Coordinate with vulnerability management, penetration testing, and incident response teams to ensure cybersecurity findings are incorporated into authorization documentation and continuous monitoring activities.
• Support annual assessments, Security Control Assessments (SCAs), audits, and authorization reviews by coordinating evidence collection, documentation updates, and stakeholder participation.
• Monitor system changes to identify potential impacts to authorization status and coordinate required documentation updates.
• Assist with contingency planning, incident response planning, interconnection security agreements, privacy documentation, and other required cybersecurity artifacts.
• Prepare recurring authorization status reports, remediation updates, and security summaries for Government stakeholders.
• Participate in change management, configuration management, governance meetings, and continuous monitoring activities to ensure cybersecurity considerations remain integrated into operational decision making.
• Coordinate closely with engineering teams to ensure security controls are properly implemented and documented.
• Support continuous improvement initiatives that strengthen authorization quality, improve documentation accuracy, and enhance operational efficiency.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related discipline.
• Three or more years of experience supporting Federal cybersecurity, RMF, Assessment and Authorization (A&A), or information assurance programs.
• Working knowledge of NIST SP 800-37, NIST SP 800-53 Rev. 5, FISMA, and Federal cybersecurity requirements.
• Experience supporting authorization package development and maintenance.
• Experience coordinating with System Owners, engineers, cybersecurity operations teams, and Government stakeholders.
• Strong organizational, analytical, and technical writing skills.
• Excellent communication skills with the ability to coordinate activities across multiple organizations.

Preferred Qualifications:

• Experience supporting NIH, HHS, or other Federal civilian agencies.
• Experience using JCAM, eMASS, ServiceNow GRC, Archer, or similar governance platforms.
• Experience supporting continuous monitoring, vulnerability management, POA&M management, and cybersecurity assessments.
• Familiarity with cloud environments, Zero Trust initiatives, and enterprise security operations.
• Experience supporting FISMA reporting, audit preparation, and ongoing authorization programs.

Preferred Certifications:

One or more of the following is preferred:

• Security+
• Certified in Governance, Risk and Compliance (CGRC)
• CAP (Certified Authorization Professional)
• CISSP
• CISM

Benefits

• Competitive salary, paid twice per month
• Best in class medical coverage
• 100% of medical premiums covered by True Zero
• Company wide new business incentive programs
• Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.)
• 3 weeks of PTO starting + 11 Paid Holidays Annually
• 401k Program with 100% company match on the first 4%
• Monthly reimbursement of Cell Phone and Home Internet costs
• Paternity/Maternity Leave
• Investment in training and certifications to broaden and deepen your technical skills