Information System Security Officer (ISSO)

Information System Security Officer (ISSO)The ISSO will provide senior-level, hands-on cybersecurity support for assigned federal information systems and will be qualified to assume Lead ISSO responsibilities during scheduled or unscheduled absences. The position will support Risk Management Framework (RMF), authorization, continuous monitoring, vulnerability management, POA&M management, audit readiness, and cybersecurity compliance activities across enterprise and cloud environments.The Senior ISSO will work closely with the Lead ISSO, Government ISSM, System Owners, technical teams, assessors, and other cybersecurity stakeholders to maintain system security posture, develop and maintain authorization artifacts, track remediation activities, review security controls and evidence, and support Government cybersecurity reviews and audits.Candidates with a combination of federal RMF/ISSO experience, a recognized cybersecurity certification, and Microsoft security certifications will be strongly preferred.Required / Strongly Desired QualificationsExperience supporting cybersecurity, information assurance, or ISSO activities in a federal environmentHands-on experience with FISMA, NIST RMF, NIST SP 800-53, FedRAMP, ATO packages, SSPs, continuous monitoring, vulnerability management, and POA&M managementExperience supporting FISMA Moderate systems, major applications, general support systems, or FedRAMP-authorized cloud servicesWorking familiarity with cybersecurity tools and platforms such as CSAM, ServiceNow, Splunk, Tenable Nessus or Qualys, Microsoft Defender, Azure, Microsoft 365, Entra ID, Intune, Okta, Palo Alto, and ZscalerStrong technical writing, documentation, risk analysis, and stakeholder communication skillsMust be a U.S. CitizenMust be eligible to successfully complete and maintain a Tier 4 background investigationMicrosoft Certifications One or more Microsoft security certifications is requiredSC-500 – Microsoft Certified: Cloud and AI Security Engineer AssociateSC-300 – Microsoft Certified: Identity and Access Administrator AssociateSC-200 – Microsoft Certified: Security Operations Analyst AssociateSC-100 – Microsoft Certified: Cybersecurity Architect ExpertOther relevant Microsoft Azure, Microsoft 365, security, identity, or compliance certificationsCybersecurity Certifications One or more of the following is highly desirable:CISSPCompTIA Security+CISMCGRC / CAPCCSPSimilar recognized cybersecurity or information assurance certificationCorporate ResourcesUnlike traditional ISSO positions that are primarily compliance and documentation focused, this role is backed by a broader cybersecurity and engineering organization. You will have access to a large cybersecurity laboratory environment, engineering resources, and reach-back subject matter experts across cloud, networking, identity, systems engineering, application security, vulnerability management, security operations, and federal cybersecurity compliance.You will be able to use these resources to investigate technical issues, validate security approaches, reproduce and assess configurations, evaluate emerging technologies, and develop practical solutions to security and compliance challenges. The position offers an opportunity to lead not only the execution of RMF activities, but also to help shape the technical approaches, processes, tools, and practices used by the cybersecurity team.Technical Environment and Professional ResourcesYou will be supported by capabilities beyond those normally available to an embedded ISSO team, including:Access to a dedicated cybersecurity and engineering laboratory for testing, validation, prototyping, and technical investigationReach-back access to experienced cybersecurity, cloud, network, systems, identity, application, and infrastructure SMEsOpportunities to work directly with engineers to translate security findings and control requirements into implementable technical solutionsAbility to evaluate and test security tools, configurations, architectures, and remediation approaches outside of the production environmentAccess to organizational lessons learned, technical expertise, reusable engineering approaches, and cybersecurity research developed across other federal programsOpportunity to help mature the team's RMF, continuous monitoring, vulnerability management, security engineering, and automation practicesAbility to influence the technical direction and operating model of a growing federal cybersecurity team