Senior Information Systems Security Officer

Senior Information Systems Security Officer

We are seeking a Senior Information Systems Security Officer to join our dynamic team. In this role, you will lead our client's ISSO and Risk and Compliance teams, overseeing activities related to risk management, compliance, and information system security. Your expertise in FedRAMP, RMF, and accreditation assessments will be crucial in ensuring our client's systems adhere to Federal standards.

Responsibilities:

• Accreditation Assessments: Perform security control assessment services for clients in commercial and government sectors, ensuring compliance with NIST RMF and FedRAMP requirements. Develop and review RMF packages with meticulous attention to detail and accuracy. Assist contract companies in meeting Federal agency including OMB, and EO or Intelligence Community mandates for security compliance. Collaborate with private entities to establish effective cybersecurity programs, particularly for critical infrastructure. Maintain FISMA authorization to operate for information systems through internal audits and adherence to NIST RMF security controls. Act as the primary advisor on NIST RMF compliance, offering guidance on resolving outstanding issues and meeting security control requirements. Conduct comprehensive security control assessments following NIST, IHS, and CISA guidelines. Provide expert recommendations to the Approval Official regarding network and system authorizations. Assist with implementing General Support Systems (GSS). Assist with implementing Common Controls. Assist advising continuous monitoring and implementing RBD program. Train and educate team members and stakeholders on NIST RMF principles and best practices.

• FedRAMP Compliance: Serve as the organization's trusted Subject Matter Expert (SME) for FedRAMP, wielding a deep understanding of its requirements, guidelines, and controls. Continuously update your FedRAMP knowledge to advise the organization of new requirements, guidelines, and controls. Conduct internal FedRAMP readiness assessments to identify and remediate gaps or deficiencies prior to Third-Party Assessment Organizations (3PAOs) assessments. Coordinate FedRAMP readiness assessments with 3PAOs. Develop and maintain essential FedRAMP compliance documentation (System Security Plans (SSPs), Security Assessment Reports (SARs), and Plan of Actions and Milestones (POA&Ms). Assist with remediating any findings identified during FedRAMP assessments and preparing for audits by the Federal government or authorized entities. Act as a liaison with the FedRAMP program office to facilitate effective communication and compliance alignment.

• ISSO Tasks: Develop a real-time risk management system that fosters collaboration and enhances security practices within the organization. Conduct regular security risk analyses for hospitals and healthcare systems to identify vulnerabilities and mitigate potential threats. Provide daily advisory support to the National Security Director, addressing security concerns and participating in the implementation of a robust incident response program. Stay abreast of Healthcare IT technologies and apply NIST 800 series methodologies to safeguard them effectively. Train and mentor IT Security Team members, equipping them with the knowledge and skills needed to perform their roles efficiently. Provide technical leadership to accreditation assessors and ISSOs. Conduct analysis of current environment and provide recommendations to align accreditation processes with NIST and RMF guidance. Create and maintain information security policies in compliance with NIST and HIPAA regulations. Utilize Archer to develop and maintain system accreditation lifecycle workflows and ATO packet management processes. Conduct comprehensive security control assessments following NIST, IHS, and CISA guidelines.

Qualifications:

• Years of Experience: 10+ Years Relevant Experience
• Education Level: Bachelor's Degree; Master's Degree preferred
• Clearance Requirements: Public Trust
• Certification Requirements: CISSP
• Any other work-related qualifications needed for the role: Experience leading large projects in a Federal healthcare environment. Strong knowledge and understanding of HIPAA, PII, NIST, FISMA, and FedRAMP. Proficiency with Nessus and Archer GRC (2 years desired). Expert knowledge of RMF, NIST, accreditation assessments, and DISA-STIGs. Excellent communication and briefing skills for client leadership.