> Markdown version of [/jobs/ext/2589434-xacta-saas-information-system-owner-iso](https://www.wearedevelopers.com/jobs/ext/2589434-xacta-saas-information-system-owner-iso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Xacta SaaS Information System Owner (ISO) - **Company:** Telos Corporation - **Location:** Ashburn, VA, United States - **Salary:** $105,000.0 - $130,000.0 - **Contract:** Permanent contract - **Skills:** Xacta, Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Software as a Service, Cloud Computing, Cloud Computing Security, Configuration Management, Cyber Security, Information Systems, Continuous Integration, Identity and Access Management, Network Security, Cloud Services, Security Software, Security Information and Event Management, Software Vulnerability Management, Data Logging, Information Security Management System, Cloud Platform System, Prompt Engineering, Software Security, HybridCloud, Kubernetes, Infrastructure Automation Frameworks, Information Technology, RSA Archer Platform, Devsecops, Plan of Action and Milestones, Vulnerability Analysis - **Published:** August 31, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9130329/xacta-saas-information-system-owner-iso ## About the Role * US Citizen * Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related discipline, or equivalent combination of education and relevant professional experience. * One or more relevant professional certifications such as CISSP, CISM, CCSP, CGRC, comparable cybersecurity credentials. * Approximately 5 - 7 years or more of progressive experience in cybersecurity, information assurance, cloud security, security operations, or related disciplines. * Demonstrated experience supporting FedRAMP, NIST Risk Management Framework (RMF), FISMA, or comparable federal security authorization environments. * System Security Plans, Plans of Action and Milestones (POA&M's), continuous monitoring, vulnerability management, security control assessments, control evidence collection, and risk-management activities. * Experience with Xacta or other GRC platforms * Experience operating or securing enterprise cloud or SaaS environments. * Working knowledge of cloud security concepts including identity and access management, network security, encryption, logging and monitoring, vulnerability scanning, configuration management, and incident response. * Ability to interpret technical vulnerability, configuration, and security data and translate findings into remediation priorities and risk decisions. * Experience coordinating security activities across engineering, operations, cybersecurity, and compliance teams. * Experience supporting security assessments, audits, or independent third-party assessments. * Strong analytical, written, verbal, and executive communication skills. * Ability to communicate technical and regulatory issues effectively to both technical and non-technical stakeholders., * Direct experience supporting or maintaining a FedRAMP CSO environment. * AWS certification; or related cloud security certification * Working knowledge and use of Artificial Intelligence (AI) Tools, prompt engineering and agentic workflows * Experience interacting directly with 3PAOs, government assessors, or authorizing organizations. * Experience with DevSecOps environments, CI/CD pipelines, containers, Kubernetes, infrastructure as code, and automated security tooling. * Experience with API Security, automated evidence collection, and continuous control monitoring. * Familiarity with FedRAMP 20x and machine-readable security and compliance standards like OSCAL. * Experience integrating security telemetry from vulnerability scanners, cloud platforms, SIEM systems, CI/CD pipelines, and related security tools. * Experience supporting federal government customers or regulated cloud environments. The successful candidate must meet eligibility requirements to access sensitive information, which requires US citizenship. ## Description We are seeking an experienced Information System Owner (ISO) to provide security, risk, compliance, and authorization leadership for a FedRAMP-authorized Cloud Service Offering (CSO). The ISO will serve as the accountable operational owner for maintaining the system's availability, security and authorization/certification posture, ensuring that the production environment remain aligned with applicable FedRAMP and NIST requirements. This role requires a combination of cybersecurity expertise, cloud and DevSecOps knowledge, risk-management judgment, and the ability to coordinate activities across engineering, operations, security, compliance, product, and executive stakeholders. The successful candidate will be able to translate regulatory requirements into practical operational controls while identifying opportunities to automate compliance activities and reduce the cost and effort required to maintain authorization., * Serve as the primary operational owner for the CSO's FedRAMP Certification and operational posture. * Maintain alignment among the production environment, authorization boundary, System Security Plan (SSP), security controls, architecture documentation, inventories, policies, procedures, and supporting evidence. * Coordinate FedRAMP continuous monitoring activities and required recurring deliverables. * Oversee availability, vulnerability management, remediation tracking, POA&M activities, deviations, exceptions, and risk-acceptance processes. * Evaluate infrastructure, application, architecture, and configuration changes for security, compliance, and authorization impact. * Coordinate control owners and technical teams to ensure NIST SP 800-53 security requirements are appropriately implemented and evidenced. * Partner with DevSecOps and engineering teams on secure cloud architecture, CI/CD processes, configuration management, IAM, logging, encryption, vulnerability management, and related security capabilities. * Coordinate responses to 3PAO assessments, annual assessments, penetration testing, government reviews, customer inquiries, and evidence requests. * Evaluate findings and security issues based on technical severity, operational impact, regulatory requirements, and overall system risk. * Escalate significant risks, compliance deficiencies, and authorization concerns to appropriate technical and executive stakeholders. * Support incident response, contingency planning, system recovery, and related FedRAMP operational security requirements. * Identify opportunities to automate security and compliance activities, including control evidence collection, asset reconciliation, vulnerability workflows, compliance telemetry, and recurring reporting. * Develop security and risk metrics that provide leadership with visibility into the CSO's operational and authorization posture. * Promote continuous improvement of security, compliance, and DevSecOps processes. ## Related Videos - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [Understanding Kubernetes in a visual way](https://www.wearedevelopers.com/videos/100085-understanding-kubernetes-in-a-visual-way) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) - [Instant KAI Sandboxes with vCluster: Multi-Tenant, Multi-Scheduler GPU Sharing](https://www.wearedevelopers.com/videos/100333-instant-kai-sandboxes-with-vcluster-multi-tenant-multi-scheduler-gpu-sharing) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence) - [Why Attend a Developer Event in 2026?](https://www.wearedevelopers.com/magazine/688-why-attend-a-developer-event-in-2026)