Senior Information System Security Officer (ISSO)

Senior ISSOJoin Our Team Devis is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.About This RoleAs a Senior ISSO, you will perform senior ISSO duties for assigned systems and lead an assigned area of the program spanning authorization, continuous monitoring, vulnerability and POA&M management, audit support, and compliance. You will work directly in the agency's compliance platform rather than around it, and you will be expected to produce artifacts a federal assessor can accept without a round of rework.What You'll DoMaintain Authorization PackagesMaintain authorization packages, control implementation statements, inheritance records, and POA&M items in CSAM for assigned systemsDevelop and recommend system security categorizations and control baselines, documenting tailoring rationaleReconcile inherited controls against current cloud provider and common control provider documentationKeep records audit-ready and internally consistent between the compliance platform and supporting repositoriesRun Continuous MonitoringExecute continuous monitoring plans: recurring security reviews, Splunk log ingestion verification, and monthly posture reportingAnalyze vulnerability scan results from Tenable, Qualys, and Microsoft Defender; validate findings and document false-positive rationale with supporting evidenceCoordinate remediation with engineering teams and track POA&M items to closure with bidirectional ServiceNow traceabilityProduce monthly reporting that gives federal stakeholders analysis and recommended action, not raw data extractsAnalyze Change and Support GovernancePrepare security impact analyses for change requests within contract turnaround timesSupport change advisory and change control board meetings, and perform post-change verificationAnalyze proposed changes for significant-change implications and prepare the resulting assessment packagesSupport Incidents and AuditsProvide ISSO-side incident response coordination: affected-system context from CSAM within one business hour of declaration, situation reports, root cause analysis inputs, and corrective action trackingSupport audits, assessments, and FISMA reporting through evidence staging, auditor coordination, draft finding responses, and corrective action plansCover the LeadStep into Lead ISSO duties during planned and unplanned absences without a drop in serviceRepresent the team in agency governance forums when the Lead is unavailableLead internal quality reviews of deliverables when acting in the Lead roleAreas of Focus Both positions carry the identical qualification bar and both must be able to assume the Lead ISSO role. They differ only in primary area of ownership, and each area has a trained backup so that no part of the program depends on one person.Monitoring and Remediation: primary owner of continuous monitoring and security posture management and of vulnerability and POA&M execution, and the coordination point for incident responseAuthorization and Assurance: primary owner of security documentation and artifact management, security impact analysis and change coordination, and audit, assessment, and compliance support, working alongside the Lead ISSO on authorization efforts. Depth in CSAM is prioritized for this position.What We're Looking For Required Qualifications Education & ExperienceBachelor's degree in cybersecurity, computer science, information systems, or a related technical disciplineMinimum 8 years of ISSO, security control assessment, or Risk Management Framework experience supporting federal information systemsDemonstrated production of RMF artifacts: System Security Plans, control implementation statements, assessment evidence, and POA&MsReadiness to assume Lead ISSO responsibilities, including governance-forum representation and internal quality review leadershipRequired CertificationsCISSP, CGRC (formerly CAP), or CASP+, or a comparable certificationTechnical SkillsHands-on proficiency with CSAM. A comparable federal governance, risk, and compliance platform such as eMASS or ArchAngel considered where you can demonstrate the ability to transition to CSAMServiceNow, Splunk, and at least one enterprise vulnerability scannerWorking knowledge of NIST SP 800-37 Revision 2, NIST SP 800-53, and NIST SP 800-137Clear technical writing that stands up to federal review without reworkPreferred QualificationsFedRAMP shared-responsibility documentation experienceMicrosoft Azure Government and Microsoft 365 GCC High familiarityPrivacy documentation support, including Privacy Threshold Analyses and Privacy Impact AssessmentsExperience with Microsoft Defender for Endpoint, Identity, and CloudCurrent or recent Tier 4 High-Risk Public Trust adjudication, or higherPerformance ExpectationsAuthorization records for assigned systems accurate, current, and internally consistentFindings triaged and reported inside contract turnaround timesMonthly reporting federal stakeholders can act on directlyAble to cover the Lead role on short notice without a dip in serviceSpecial RequirementsPrimarily remote, with in-person presence required at DFC headquarters in Washington, DC on an as-needed basis for governance meetings, audits, and assessments. Candidates based in the Washington, DC metropolitan area are preferred.Authorization to work in U.S. without restriction.Must be eligible for and able to obtain a Tier 4 High-Risk Public Trust background investigation. Adjudication must be complete before privileged access to enterprise security tools or authorization repositories is granted.Must obtain and maintain an agency-issued PIV card.Must complete agency cybersecurity, privacy, records management, insider threat, and applicable role-based training on entry and annually thereafter.Availability during core business hours, 7:00 a.m. to 6:00 p.m. Eastern, Monday through Friday, excluding federal holidays, and participation in a shared on-call rotation for off-hours incident acknowledgment.Compensation & Benefits$99,000.00 - $109,000.00 salary commensurate with experience and qualifications.This position is contingent upon contract award.Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual's race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.