Senior Information System Security Officer

Sr. ISSO

For immediate response, please send to View email address on click.appcast.io: Updated WORD resume, desired hourly/salary rate, and best time to speak!

Location: FEMA St. Elizabeth Campus (SE DC) - Currently remote but must be comfortable coming on-site when needed

Duration: 6 Month Contract to Hire (Brand New 5 Year Contract)

MUST HAVES:

• Ability to obtain and maintain a DHS Public Trust up to a Top Secret Clearance
• BS & 10 YOE OR AS & 13 YOE OR 16+ YOE
• Experience manage RMF process and POA&Ms
• Comfortable managing multiple systems at once and assisting with automating systems

Shift: Monday - Friday, 9 AM - 5 PM

Environment:

• In discussions with the CISO, it was clear that the security program and systems have been neglected for at least a year, if not longer.
• While documentation, artifacts, and security plans may exist, there is little confidence that they are current, complete, or in good condition.
• The CISO's primary goal is to get the environment back on track and clean up existing security and compliance issues.
• Focused on increasing automation wherever possible to improve efficiency and reduce manual effort.
• The immediate focus is remediation and stabilization, with automation initiatives to follow once processes are back under control.
• The environment consists of roughly 90 systems, although the exact number is unclear.
• The team wants to move away from assigning ISSOs to individual systems and instead organize responsibilities by security control areas (e.g., Access Control, Configuration Management) across all systems.
• Rather than owning a specific set of systems, ISSOs would be responsible for managing and monitoring their assigned control families enterprise-wide.
• There is not a high level of confidence in the current patch management process and patching posture across the environment.

Skillset:

• Senior ISSO with 10+ years of Information Security experience supporting federal systems
• Deep expertise leading the full RMF lifecycle and ATO process end-to-end
• Strong knowledge of FISMA, NIST 800-37, NIST 800-53, DHS 4300 Series, and federal cybersecurity requirements
• Experience serving as the primary cybersecurity lead/advisor for system owners, PMOs, and senior leadership
• Hands-on experience developing and maintaining SSPs, POA&Ms, Configuration Management Plans, Contingency Plans, and Incident Response Plans
• Experience conducting risk assessments, annual security assessments, vulnerability assessments, and continuous monitoring activities
• Ownership of POA&M management, remediation planning, audit findings, and compliance tracking
• Experience performing Security Impact Analyses, change request reviews, and configuration management activities
• Ability to develop and maintain authorization boundary diagrams, security architectures, and security requirement traceability matrices
• Experience with security control implementation, self-assessments, control inheritance, and business impact analyses
• Strong background supporting security audits, ATO packages, compliance reviews, and accreditation efforts
• Experience developing remediation plans and advising stakeholders on cybersecurity risks and compliance requirements
• Familiarity with CSAM, eMASS, RegScale, or similar GRC platforms
• Knowledge of cloud security and FedRAMP authorization processes
• Strong communication skills with the ability to brief executives, present risk findings, and work directly with senior leadership
• Preferred experience supporting DHS, FEMA, DoD, or other federal agencies
• CISSP, CISM, or CASP+ certification preferred (IAT Level III equivalent)