Senior Information System Security Officer (ISSO)

• Develop, maintain, and update RMF documentation, including System Security Plans (SSPs), security assessment artifacts, control implementation statements, risk assessments, continuous monitoring plans, and POA&Ms.
• Coordinate with system owners, information system security managers, engineers, administrators, and assessors to implement and validate security controls.
• Review and analyze vulnerability scan results, compliance findings, and security assessment results to identify risks and develop remediation recommendations.
• Use Assured Compliance Assessment Solution (ACAS), Cyber Management Review System (CMRS), Security Technical Implementation Guides (STIGs), and related cybersecurity tools to assess and improve system security posture.
• Track vulnerabilities, findings, waivers, exceptions, and remediation activities; manage POA&Ms through closure or risk acceptance by the appropriate authority.
• Support the security of public-facing systems and components by identifying, documenting, and mitigating risks associated with externally accessible services.
• Perform continuous monitoring activities, including periodic control reviews, vulnerability management, configuration compliance reviews, and security artifact updates.
• Prepare senior-level status reports, risk summaries, briefings, and recommendations for program leadership and cybersecurity stakeholders.
• Provide technical guidance and mentorship to junior RMF, ISSO, and cybersecurity personnel

The successful candidate will have prior experience work with system owners, security control assessors, engineers, administrators, and program stakeholders to ensure systems maintain an acceptable security posture and meet applicable Army cybersecurity and RMF requirements. This role requires extensive experience supporting complex environments, including public-facing components, and managing security vulnerabilities, findings, and Plans of Action and Milestones (POA&Ms).

Knowledge of, or experience applying, artificial intelligence (AI), automation, or advanced analytics to improve cybersecurity operations is highly preferred. This may include using AI-enabled tools to support vulnerability prioritization, security documentation review, continuous monitoring, risk analysis, compliance reporting, and remediation tracking., * Bachelor’s degree in cybersecurity, information technology, computer science, information systems, engineering, or a related discipline.

• 10-12 years of progressively responsible experience in cybersecurity, information assurance, RMF, or information system security.
• Demonstrated experience supporting RMF activities across all phases, including documentation, security control implementation, assessment support, authorization activities, and continuous monitoring.
• Experience serving as an Army ISSO or in a substantially equivalent information system security role supporting Army systems.
• Demonstrated experience developing, maintaining, and reviewing RMF security documentation and authorization packages.
• Experience using ACAS, CMRS, STIGs, and vulnerability-management processes to identify, assess, and remediate cybersecurity risks.
• Experience managing POA&Ms, including documenting findings, assigning corrective actions, tracking remediation progress, and supporting closure decisions.
• Experience supporting cybersecurity requirements for public-facing systems or externally accessible components.
• Strong understanding of vulnerability management, configuration compliance, security control assessment, risk documentation, and continuous monitoring practices.
• Ability to communicate complex technical risks and compliance issues clearly to technical teams, program managers, and senior leadership.
• Ability to work independently, prioritize multiple efforts, and lead coordination across diverse technical and programmatic stakeholders.
• Active Secret clearance; US Citizenship required, * Master’s degree in cybersecurity, information technology, information systems, engineering, or a related field.
• Relevant cybersecurity or RMF certifications, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Authorization Professional (CAP), Security+, or similar credentials.
• Experience supporting Army enterprise systems, cloud environments, hybrid infrastructure, or DevSecOps programs.
• Knowledge of applying artificial intelligence (AI), machine learning, automation, or advanced analytics to cybersecurity activities, such as vulnerability prioritization, security-event analysis, compliance monitoring, documentation review, or POA&M management.
• Experience serve as a cybersecurity subject matter expert supporting the development and automation of AI-enabled RMF software, translating RMF processes, NIST SP 800-53 control requirements, assessment activities, and cybersecurity workflows into software requirements and automated capabilities.
• Experience evaluating the cybersecurity implications, governance considerations, and security controls associated with AI-enabled systems or tools.
• Experience developing dashboards, metrics, or automated workflows for RMF status reporting, vulnerability management, or continuous monitoring.

At COLSA, people are our most valuable resource and centered at our core value. We invite you to unite your talents with opportunity and be a part of our “Family of Professionals!” Learn about our employee-centric culture and benefits here: https://www.colsa.com/culture_benefits