Senior Information System Security Officer

Senior Information System Security Officer (ISSO) / POA&M Remediation and Compliance Specialist

Position Summary

The Senior Information System Security Officer (ISSO) / POA&M Remediation and Compliance Specialist will provide senior-level cybersecurity, risk management, and compliance support for the Acquisition Systems Branch's PRM2 solution. This position will work closely with the PRM2 ISSO, system owners, technical teams, and other Government stakeholders to ensure the system complies with Department of Homeland Security cybersecurity requirements.

The Senior ISSO will support security assessments, maintain required security documentation, coordinate vulnerability remediation, monitor Plans of Action and Milestones (POA&M), and support the timely achievement and maintenance of an Interim Authority to Operate (IATO) and Authority to Operate (ATO). The position requires practical experience translating identified security weaknesses into documented, trackable, and verifiable remediation actions.

Key Responsibilities

ISSO and Cybersecurity Compliance Support

• Provide senior-level cybersecurity and compliance support to the PRM2 ISSO, system owner, and applicable Government stakeholders.
• Assist with maintaining PRM2 compliance with DHS information technology security requirements.
• Provide cybersecurity documentation, analysis, and technical support during security assessments, audits, authorization activities, and recurring compliance reviews.
• Coordinate with application, database, infrastructure, operations, and security personnel to address cybersecurity requirements affecting PRM2.
• Monitor changes to the PRM2 environment and evaluate their potential impact on the system's security authorization and compliance posture.
• Support implementation of security best practices throughout the system development and operational lifecycle.
• Participate in cybersecurity audits and assessments as required.

Authority to Operate and Interim Authority to Operate

• Support the planning, preparation, coordination, and maintenance of the security documentation required to obtain and maintain an ATO.
• Support achievement of an IATO when required prior to obtaining the full ATO.
• Ensure authorization activities and supporting documentation comply with DHS MD 4300A and applicable DHS cybersecurity requirements.
• Coordinate the collection, review, and organization of security evidence needed to support authorization decisions.
• Track authorization milestones, open compliance actions, responsible parties, dependencies, and completion dates.
• Work with technical and program stakeholders to resolve deficiencies that may delay an IATO or ATO decision.
• Support the maintenance of authorization documentation after approval to ensure the system remains compliant as configurations, technologies, and operating conditions change.

POA&M Management and Remediation

• Develop, review, maintain, and track POA&M entries associated with security assessments, vulnerability scans, audits, penetration testing, configuration reviews, and other compliance activities.
• Validate that each POA&M item clearly identifies the security weakness, affected component, risk, corrective action, responsible owner, required resources, milestones, and target completion date.
• Coordinate with technical teams and system stakeholders to develop practical corrective action plans for identified weaknesses.
• Monitor remediation progress and identify overdue, delayed, or blocked corrective actions.
• Facilitate recurring POA&M review meetings with technical owners and Government stakeholders.
• Review remediation evidence to determine whether corrective actions have been completed and adequately documented.
• Support requests to close, extend, revise, or otherwise update POA&M items based on documented remediation status.
• Maintain traceability between findings, POA&M actions, remediation evidence, vulnerability scan results, and applicable security requirements.
• Escalate material risks, missed milestones, and unresolved findings to the PRM2 ISSO and appropriate program leadership.

Security Documentation

• Develop and maintain an updated IT Security Plan that describes the approach, methods, controls, and safeguards used to comply with Government and DHS cybersecurity requirements.
• Create, review, and update security documentation required to support assessments and authorization activities.
• Ensure security documentation reflects the system's current operating environment, architecture, boundaries, technologies, interfaces, and implemented safeguards.
• Maintain supporting evidence in an organized and audit-ready manner.
• Coordinate document reviews, comments, revisions, approvals, and version control with Government and contractor stakeholders.
• Identify documentation gaps and work with responsible parties to obtain or develop missing information.

Vulnerability Management and Patching

• Coordinate and provide pertinent vulnerability scans for the PRM2 environment.
• Review vulnerability scan results to identify findings affecting the operating system, database, application, and other components within the PRM2 authorization boundary.
• Work with system administrators, database administrators, application teams, and infrastructure personnel to prioritize and execute required remediation and patching.
• Track vulnerabilities from initial identification through remediation, verification, and closure.
• Validate remediation through rescanning, technical evidence, or other approved verification methods.
• Identify vulnerabilities that cannot be remediated within required timeframes and ensure they are appropriately documented and tracked.
• Provide the PRM2 ISSO with updates concerning patches affecting PRM2 and its authorization boundary, excluding the DEC AWS environment where specified.
• Communicate patch status, remediation dependencies, known exceptions, and residual risks to Government stakeholders.
• Support the establishment and maintenance of an ongoing vulnerability management process.

Configuration and Change Management

• Notify and update the PRM2 ISSO regarding hardware and software configuration changes affecting the PRM2 authorization boundary.
• Review proposed configuration changes for potential cybersecurity and compliance impacts.
• Support security impact analyses for changes to operating systems, databases, applications, interfaces, infrastructure, and system components.
• Ensure approved changes are accurately reflected in security plans, diagrams, inventories, procedures, and authorization documentation.
• Coordinate with change management and technical teams to verify that security requirements are addressed before changes are implemented.
• Monitor configuration changes that may introduce new vulnerabilities, alter existing safeguards, or affect the system's authorization status.

Security Assessment and Audit Support

• Support internal and external security assessments, compliance reviews, authorization reviews, and cybersecurity audits.
• Coordinate the collection and submission of requested documentation and security evidence.
• Assist technical and business stakeholders in preparing for assessor interviews, control reviews, and evidence demonstrations.
• Analyze assessment findings and coordinate corrective actions with responsible technical owners.
• Maintain an audit-ready repository of security documentation, scan results, remediation evidence, configuration information, and approval records.
• Track assessment findings through final resolution and documented closure.

Risk Communication and Reporting

• Prepare recurring cybersecurity status reports for the PRM2 ISSO, program management, and Government stakeholders.
• Report the status of ATO and IATO activities, POA&M items, vulnerabilities, patches, open findings, configuration changes, and compliance risks.
• Identify risks that could affect authorization milestones or continued system operations.
• Present technical cybersecurity issues in clear business and mission terms for leadership decision-making.
• Recommend risk treatment actions, remediation priorities, and escalation paths based on the severity and operational impact of identified weaknesses.

Required Qualifications

• Bachelor's degree in cybersecurity, information technology, computer science, information systems, engineering, or a related discipline.
• Senior-level experience supporting federal information system security, cybersecurity compliance, or security authorization activities.
• Demonstrated experience supporting ATO and, when applicable, IATO preparation and maintenance.
• Experience managing POA&M development, remediation tracking, evidence validation, milestone updates, and closure activities.
• Experience reviewing and coordinating vulnerability scans, patching, remediation, and verification activities.
• Experience developing and maintaining cybersecurity plans, assessment documentation, and authorization evidence.
• Knowledge of federal risk management and information security principles.
• Ability to interpret cybersecurity requirements and translate them into actionable technical, programmatic, and documentation tasks.
• Experience supporting security assessments, audits, compliance reviews, and authorization activities.
• Strong written communication, documentation, coordination, and stakeholder-management skills.
• Ability to communicate effectively with Government ISSOs, system owners, assessors, program managers, developers, engineers, administrators, and executive stakeholders.

Preferred Qualifications

• Experience supporting DHS information systems and cybersecurity requirements.
• Working knowledge of DHS MD 4300A.
• Experience supporting acquisition, procurement, or mission-business systems.
• Experience with application, operating system, and database security.
• Experience performing security impact analyses for hardware, software, configuration, and boundary changes.
• Experience maintaining security documentation and supporting evidence in an audit-ready environment.
• Relevant cybersecurity certification such as CISSP, CISM, CISA, CAP/CGRC, CASP+, or Security+.

Core Competencies

• Information System Security Officer support
• POA&M development and remediation
• ATO and IATO coordination
• Cybersecurity compliance
• Vulnerability and patch management
• Security assessment support
• Security documentation
• Risk identification and reporting
• Configuration and change management
• Audit evidence management
• Corrective action tracking
• Stakeholder coordination
• Continuous compliance monitoring

Performance Standards and Milestones

Interim Authority to Operate

• Support achievement of an IATO within six months of contract award, when an IATO is required.
• Maintain full compliance with applicable security requirements throughout the IATO process.
• Performance will be evaluated at each applicable milestone.

Authority to Operate

• Support achievement of an ATO within 12 months of contract award.
• Maintain compliance with applicable DHS cybersecurity requirements following authorization.
• Performance will be evaluated at each applicable milestone.

POA&M and Remediation Performance

• Maintain current, accurate, and adequately documented POA&M records.
• Track corrective actions against established milestones and target completion dates.
• Provide timely notification of delayed, blocked, overdue, or high-risk remediation items.
• Ensure closure recommendations are supported by sufficient remediation and validation evidence.

Security Documentation

• Maintain the IT Security Plan and associated security documentation in an accurate and current condition.
• Update applicable documentation when material system, boundary, configuration, hardware, or software changes occur.
• Maintain security evidence in an organized and audit-ready format.

Vulnerability and Patch Management

• Provide applicable vulnerability scan information and coordinate necessary remediation and patching.
• Notify the PRM2 ISSO of relevant patches and configuration changes affecting the PRM2 authorization boundary.
• Maintain traceability among vulnerabilities, remediation actions, verification evidence, and closure decisions.