> Markdown version of [/jobs/ext/2617862-lead-information-system-security-officer-isso](https://www.wearedevelopers.com/jobs/ext/2617862-lead-information-system-security-officer-isso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Information System Security Officer (ISSO) - **Company:** Development InfoStructure - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $137,000.0 - $147,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Microsoft Azure, Cyber Security, Information Systems, Federal Information Processing Standards (FIPS), Information Security Management, Zero Trust Network Access, Information Technology, Tenable Nessus, Splunk, Qualys, Servicenow, Plan of Action and Milestones, Vulnerability Analysis - **Published:** August 4, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=678afc6138dfaacc ## About the Role * Bachelor's degree in cybersecurity, computer science, information systems, or a related technical discipline * Minimum 10 years of cybersecurity experience * At least 5 years in ISSO, ISSM, or Risk Management Framework-centric roles supporting federal information systems * Demonstrated experience leading RMF authorization efforts under NIST SP 800-37 Revision 2, including System Security Plans, security assessment plans and reports, and POA&M lifecycle management * Experience presenting to and coordinating with federal governance bodies and authorizing officials Required Certifications * CISSP or CISM, or a comparable advanced security certification Technical Skills * Hands-on experience with a federal governance, risk, and compliance platform. CSAM strongly preferred; eMASS, ArchAngel, or a comparable platform considered where you can demonstrate the ability to transition to CSAM * Working proficiency with ServiceNow, Splunk, and an enterprise vulnerability scanner such as Tenable Nessus or Qualys * Working knowledge of NIST SP 800-53, NIST SP 800-137, FIPS 199, and CISA Binding Operational Directive requirements including the Known Exploited Vulnerabilities catalog * Federal-quality technical writing that an authorizing official or independent assessor can rely on without follow-up Leadership Capabilities * Track record of directing technical staff and holding a team to measurable service levels * Ability to translate technical risk into terms federal executives can act on * Sound judgment about the boundary between contractor recommendation and government decision authority Preferred Qualifications * FedRAMP inherited-control documentation experience, including Customer and Shared Responsibility Matrix reconciliation * Microsoft Azure Government and Microsoft 365 GCC/GCC High experience * Zero Trust architecture experience * Privacy documentation experience, including Privacy Threshold Analyses and Privacy Impact Assessments * Prior experience supporting a small federal agency or a CISO organization * Current or recent Tier 4 High-Risk Public Trust adjudication, or higher ## Description As Lead ISSO, you will manage day-to-day delivery of all ISSO support services and serve as the primary technical interface with the government Information System Security Manager, the CISO, the Authorizing Official and designated representatives, System Owners, and other federal cybersecurity stakeholders. This is a hands-on leadership role rather than a purely administrative one. You will work directly in the agency's compliance platform, chair quality reviews of authorization artifacts before they reach the government, and carry the technical credibility to defend a risk position in front of federal decision-makers. What You'll Do Own Technical Execution * Direct ISSO activities across the full compliance lifecycle: program governance, Risk Management Framework and authorization support, continuous monitoring, vulnerability and POA&M management, security documentation, security impact analysis and change coordination, incident response coordination, and audit and assessment support * Oversee development, quality control, and submission of authorization packages in CSAM * Chair internal quality reviews of every deliverable before it goes to the government * Maintain personal hands-on proficiency across CSAM, ServiceNow, Splunk, and enterprise vulnerability scanning platforms Lead the Government Relationship * Serve as the primary technical interface with the government ISSM, CISO, Authorizing Official and designated representatives, System Owners, and Common Control Providers * Represent the team in agency governance forums including the Enterprise Review Board, Change Control Board, Cybersecurity Steering Committee, Risk Management Working Group, and Privacy Working Group * Prepare and present authorization decision briefings to federal leadership * Escalate risks and issues to government leadership with a recommended course of action attached Run the Program * Maintain the risk and issue register and drive items to documented closure * Produce weekly activity reports, monthly program status reports, and quarterly executive review materials * Track and report service-level and key-performance-indicator results across every work area * Coordinate with corporate program management on staffing, reporting, and invoicing Hold the Line on Service Levels * Meet rapid-response commitments, including four-hour notification on known exploited vulnerabilities, one-business-day triage of critical findings, and one-hour incident acknowledgment during core hours * Monitor first-time acceptance rates on deliverables and drive corrective action on any nonconformance * Keep records audit-ready between audits, so evidence can be produced without a scramble, * Authorization artifacts accepted by the government on first submission * Service-level and key-performance-indicator targets met across every work area * Federal stakeholders able to make risk decisions without having to come back for more information * A portfolio that stays audit-ready between audits ## Related Videos - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [AI in Production: applied AI & enterprise use cases](https://www.wearedevelopers.com/videos/100130-ai-in-production-applied-ai-enterprise-use-cases) - [Robots are coming into the wild! Full-Stack Robotics Engineers, be ready!](https://www.wearedevelopers.com/videos/479-robots-are-coming-into-the-wild-full-stack-robotics-engineers-be-ready) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)