> Markdown version of [/jobs/ext/2499865-information-systems-security-officer-isso](https://www.wearedevelopers.com/jobs/ext/2499865-information-systems-security-officer-isso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Systems Security Officer (ISSO) - **Company:** Tesla, Inc. - **Location:** Falls Church, VA, United States (Remote available) - **Salary:** $205,000.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Cloud Computing Security, Configuration Management, Cyber Security, Continuous Integration, DevOps, Monitoring of Systems, Software Vulnerability Management, Data Logging, Cloud Platform System, Nessus, Cloudwatch, Splunk, Devsecops, Vulnerability Analysis - **Published:** August 25, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=7fe2ea0382e7ccdb ## About the Role * Experience supporting or leading ATO processes in government or regulated environments. * Strong familiarity with NIST RMF, STIGs, and related compliance frameworks. * Experience maintaining security documentation, including SSPs, POA&Ms, and control evidence. * Experience with vulnerability management processes and security scanning tools. * Understanding of cloud environments (preferably AWS or AWS GovCloud) and associated security controls. * Strong understanding of system security concepts, including access control, logging, and configuration management. * Ability to interpret and apply regulatory requirements to technical systems. * Strong organizational and documentation skills. * Ability to obtain or maintain a security clearance. Preferred Experience * ACAS / Nessus * STIG compliance validation * Splunk, CloudWatch, or similar logging/monitoring tools * Experience supporting audits and assessments * Familiarity with DevSecOps practices and CI/CD environments * CMMC Level 2 practice and assessment requirements * FISMA reporting and continuous monitoring requirements * FedRAMP continuous monitoring (monthly scanning, annual assessment, significant change requests) ## Description The Role: The Information Systems Security Officer (ISSO) is responsible for overseeing the security posture and compliance of Tesla Government customer-facing systems operating in government-regulated environments. This role ensures that systems maintain Authorization to Operate (ATO) by managing compliance activities, validating control implementation, and coordinating security efforts across engineering, DevOps, and security teams. The ISSO is accountable for the accuracy, completeness, and audit readiness of security artifacts, as well as ongoing monitoring of system security posture. The role works closely with Cloud Security Engineers and DevOps to ensure that controls are implemented effectively and remain aligned with regulatory requirements. The ISSO operates with a high degree of ownership over compliance outcomes and is responsible for ensuring that systems remain secure, compliant, and audit-ready throughout their lifecycle., ATO Ownership and Compliance Management * Own ATO sustainment activities for assigned systems, ensuring continuous compliance with applicable frameworks (e.g., NIST RMF, FedRAMP, STIGs). * Maintain and manage system security documentation, including SSPs, POA&Ms, and control implementation evidence. * Ensure traceability between system controls, implementation artifacts, and compliance requirements. * Coordinate with stakeholders to prepare for and support audits, assessments, and security reviews. Security Control Oversight and Validation * Ensure required security controls are implemented, documented, and operating as intended. * Review control implementations across infrastructure, applications, and operational processes. * Validate control effectiveness through testing, review, and collaboration with engineering teams. * Identify gaps in control implementation and drive remediation efforts. Vulnerability and Risk Management * Oversee vulnerability management processes, including tracking, prioritization, and remediation of findings. * Review scan results (e.g., ACAS/Nessus, STIGs, container scans) and ensure appropriate action is taken. * Maintain and manage POA&Ms, ensuring findings are documented, tracked, and resolved in a timely manner. * Assess and communicate risk posture to stakeholders. Continuous Monitoring and Reporting * Ensure continuous monitoring activities are executed and documented appropriately. * Review system logs, alerts, and security data to validate compliance and detect anomalies. * Produce and maintain security status reports and compliance summaries. * Ensure ongoing visibility into system security posture for leadership and stakeholders. Secure Change and Configuration Oversight * Review system and application changes to ensure security and compliance requirements are maintained. * Ensure that configuration changes align with approved baselines and do not introduce compliance gaps. * Collaborate with engineering teams to integrate security requirements into delivery workflows. * Identify and escalate risks introduced through system changes. Incident Response and Security Operations Support * Support incident response activities, including documentation, coordination, and reporting. * Ensure incidents are properly tracked, investigated, and resolved in accordance with compliance requirements. * Validate that incident response processes meet regulatory and audit expectations. Coordination and Stakeholder Engagement * Act as the primary point of contact for security compliance matters for assigned systems. * Coordinate with Cloud Security Engineers, DevOps, and development teams to ensure alignment on security requirements. * Engage with government stakeholders, assessors, and auditors during reviews and evaluations. * Provide guidance on compliance requirements and security expectations to internal teams. * Provide business development expertise to company stakeholders and support leadership planning for security and compliance initiatives, * Systems maintain ATO with no significant compliance gaps or audit findings. * Security documentation is accurate, complete, and audit-ready at all times. * Vulnerabilities and risks are tracked, communicated, and resolved effectively. * Continuous monitoring activities provide clear visibility into system security posture. * Security requirements are consistently applied across system changes and operations. * The ISSO is a trusted authority on compliance and security posture for assigned systems. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [#90DaysOfDevOps - The DevOps Learning Journey](https://www.wearedevelopers.com/videos/548-90daysofdevops-the-devops-learning-journey) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)