Information System Security Officer (ISSO)

We are seeking an experienced Information System Security Officer (ISSO) to lead and maintain the security and compliance posture of our recently obtained FedRAMP-authorized cloud environment.

The ISSO will serve as the primary security compliance lead responsible for ensuring ongoing adherence to FedRAMP, NIST 800-53, FISMA, and organizational security requirements.

Key Responsibilities

• FedRAMP Program Management:
• Serve as the designated ISSO for FedRAMP-authorized systems.
• Maintain the organization's Authority to Operate (ATO) and support ongoing compliance activities.
• Lead FedRAMP continuous monitoring activities, including monthly, quarterly, and annual reporting requirements.
• Coordinate annual assessments, independent audits, penetration testing, and security reviews with Third Party Assessment Organizations (3PAOs).
• Manage security-related communications with federal agencies, sponsoring organizations, and stakeholders.

• Risk & Security Management:
• Conduct security risk assessments and vulnerability analyses.
• Review, assess, and monitor Plan of Action & Milestones (POA&M) items through remediation.
• Evaluate security impacts of system changes and support Significant Change Request (SCR) submissions.
• Ensure proper implementation and effectiveness of NIST 800-53 security controls.
• Facilitate security reviews for architecture changes, new technologies, and cloud deployments.

• Compliance & Documentation:
• Maintain FedRAMP security documentation including System Security Plan (SSP), Security Assessment Reports (SAR), POA&M, Configuration Management Plan, Incident Response Plan, Continuous Monitoring Strategy, and Contingency Planning Documentation.
• Review and approve security documentation updates resulting from system changes.
• Ensure evidence collection and compliance artifacts are complete and audit-ready.

• Continuous Monitoring:
• Manage POA&M deliverables for the sponsor.
• Monitor security events, incidents, and compliance metrics.
• Validate remediation efforts for identified security findings.
• Ensure required security assessments are completed according to established schedules.
• Track compliance KPIs and report status to leadership.

• Security Operations & Incident Response:
• Participate in security incident investigations and response efforts.
• Coordinate with security operations teams to ensure timely identification and remediation of threats.
• Support root cause analysis and corrective action planning following incidents.
• Review security monitoring tools and processes to improve detection and response capabilities.

• Cross-Functional Collaboration:
• Partner with Engineering and DevOps teams to integrate compliance into system development and deployment processes.
• Provide security guidance throughout the SDLC.
• Support cloud migration, modernization, and technology transformation initiatives.
• Ensure compliance and security awareness training meet FedRAMP requirements.
• Matrix manage resources participating in the FedRAMP Program.

Required Qualifications

• Education:
• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related field.
• Equivalent work experience may be considered in lieu of degree requirements.

• Experience:
• 5+ years of information security, cybersecurity, or compliance experience.
• 3+ years supporting FedRAMP, FISMA, or federal compliance programs.
• Experience maintaining FedRAMP Moderate or High authorized environments.
• Experience supporting security assessments, audits, and continuous monitoring activities.
• Experience with cloud platforms such as AWS, Azure, or Google Cloud.

• Technical Knowledge:
• Strong understanding of FedRAMP requirements, NIST SP 800-53, NIST 800-37 Risk Management Framework (RMF), FISMA, NIST 800-171, Zero Trust Architecture principles, vulnerability management processes, security operations, and incident response.
• Familiarity with security technologies including SIEM platforms, vulnerability scanners, endpoint detection and response (EDR), Identity and Access Management (IAM), and cloud-native security services.

Preferred Qualifications

• CISSP, CISM, GSLC, CAP, or equivalent cybersecurity certification.
• FedRAMP-specific experience acting as ISSO, Security Compliance Manager, or FedRAMP Program Manager.
• Experience supporting federal agencies or government contractors.
• Knowledge of automated compliance platforms and Governance, Risk, and Compliance (GRC) tools.
• Experience leveraging AI and automation to streamline compliance reporting, evidence collection, and POA&M management.
• Experience with AWS GovCloud or Azure Government environments.

Salary U.S. National Base Pay Range: $115,400 - $192,300. Geographic differentials may apply in some locations to better reflect local market rates.