> Markdown version of [/jobs/ext/1487174-senior-isso-security-analyst](https://www.wearedevelopers.com/jobs/ext/1487174-senior-isso-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior ISSO Security Analyst - **Company:** IronArch Technology - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Cloud Engineering, Cyber Security, Information Systems, Information Security Management, Software Engineering, Enterprise Software Applications, SARS Software Products, Cloud Platform System, Information Technology, Servicenow - **Published:** July 29, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=ab263c06ad633a4e ## About the Role * Master's degree in Computer Science, Cybersecurity, Information Technology, Electronics Engineering, or a related field with 10+ years of professional IT experience; or * 20+ years of Information Technology experience in lieu of a degree. * Extensive experience supporting all RMF lifecycle activities (Steps 0-6). * Experience creating, updating, and maintaining FISMA security documentation and RMF artifacts. * Strong knowledge of NIST SP 800-53 security controls, Risk Management Framework (RMF), FISMA, and Federal cybersecurity compliance requirements. * Experience planning secure product implementations, system major changes, and development lifecycle security activities. * Experience analyzing authorization documentation, identifying authorization gaps, and coordinating remediation efforts. * Demonstrated ability to independently lead client-facing meetings and present complex cybersecurity and ATO topics. * Strong organizational skills with the ability to manage multiple authorization packages, documentation sets, and project timelines simultaneously. * Ability to obtain and maintain a VA Public Trust Clearance. AI Capabilities * Experience using AI-assisted tools responsibly to improve cybersecurity documentation, security assessments, risk analysis, and operational efficiency. * Familiarity with evaluating AI-enabled cybersecurity capabilities while ensuring compliance with Federal security and privacy requirements. Clearance Requirements * U.S. Citizenship is required. * Ability to obtain and maintain a VA Public Trust Clearance. * Candidates with an active VA Public Trust, current Federal Public Trust, or recently completed VA background investigation are strongly preferred, as they can significantly reduce onboarding timelines. Preferred Experience * Prior experience supporting the U.S. Department of Veterans Affairs (VA) is strongly preferred. * Experience supporting Continuous Authorization and Monitoring (CAM). * Experience supporting Authorization to Operate (ATO) packages for specialized devices, enterprise applications, or cloud environments. * Experience with the VA Enterprise Cybersecurity Program (ECP) and VA Risk Management Framework (RMF) processes. * Experience using VA security tools such as eMASS, Archer, and ServiceNow. * Ability to effectively communicate with technical teams, executive leadership, and government stakeholders. * Excellent written, verbal, and presentation communication skills. * Professional certifications such as CISSP, CAP, Security+, CASP+, CISM, GSLC, or equivalent. * Active VA Public Trust or recently adjudicated Federal Public Trust is highly desirable. ## Description As a trusted cybersecurity advisor, you will work closely with VA Information System Owners (ISOs), Information System Security Officers (ISSOs), system administrators, site managers, engineers, and executive stakeholders to guide systems through the full RMF lifecycle while ensuring compliance with Federal cybersecurity requirements. You will ensure the appropriate operational security posture is maintained throughout the information system lifecycle-from system acquisition and implementation through production operations and eventual decommissioning. You'll develop and maintain comprehensive security documentation, coordinate authorization activities, identify security risks, and provide expert recommendations that enable secure deployment of enterprise IT systems. You will also serve as a subject matter expert on VA authorization policies, NIST security controls, FISMA compliance, and cybersecurity best practices while helping clients translate complex security requirements into practical, risk-based solutions. Work Location: Remote (U.S.-based). Occasional travel to VA or customer locations may be required for meetings, security reviews, or program activities. Key Responsibilities Risk Management Framework (RMF) & Authorization Support * Lead and coordinate RMF Steps 0-6 activities supporting Authorization to Operate (ATO) packages. * Support Information System Owners (ISOs), ISSOs, and system stakeholders throughout the authorization lifecycle. * Ensure compliance with VA cybersecurity policies, FISMA, NIST, and agency authorization requirements. * Support system authorizations, continuous monitoring, and annual security assessments. * Track authorization milestones, documentation updates, and artifact expiration dates across multiple systems. Security Documentation & Compliance * Develop, review, and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action & Milestones (POA&Ms), Security Impact Analyses (SIAs), and other RMF artifacts. * Document NIST SP 800-53 security control implementations and validate compliance. * Analyze authorization packages to identify deficiencies and coordinate remediation activities. * Maintain accurate and audit-ready security documentation throughout the system lifecycle. Risk Assessment & Security Advisory * Identify cybersecurity risks associated with system implementations, upgrades, and operational environments. * Develop mitigation strategies in collaboration with technical and business stakeholders. * Provide security guidance for system installations, major changes, cloud implementations, and software development efforts. * Present security findings, recommendations, and authorization status to government leadership and technical teams. Client Engagement & Collaboration * Serve as the primary cybersecurity advisor for assigned systems. * Independently lead customer meetings involving RMF, ATO, security compliance, and authorization readiness. * Collaborate with engineers, developers, project managers, system owners, and cybersecurity teams to ensure successful authorization outcomes. * Translate technical cybersecurity concepts into actionable recommendations for both technical and non-technical audiences. Continuous Improvement * Support Continuous Authorization and Monitoring (CAM) initiatives. * Recommend process improvements that streamline authorization activities and strengthen cybersecurity posture. * Stay current on evolving VA cybersecurity guidance, NIST publications, Executive Orders, and Federal security requirements. ## Related Videos - [Building Sovereign AI: Lessons from Deploying Secure RAG Systems using Confidential Computing](https://www.wearedevelopers.com/videos/100108-building-sovereign-ai-lessons-from-deploying-secure-rag-systems-using-confidential-computing) - [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [DevOps for AI: running LLMs in production with Kubernetes and KubeFlow](https://www.wearedevelopers.com/videos/1222-devops-for-ai-running-llms-in-production-with-kubernetes-and-kubeflow) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)