Senior Information Systems Security Officer (ISSO)

Conduct comprehensive technical security assessments, vulnerability evaluations, and compliance reviews to identify cybersecurity risks and recommend appropriate mitigation strategies.

Support the design, implementation, and continuous improvement of information system security controls, cybersecurity processes, and enterprise security initiatives

Ensure assigned information systems comply with applicable Intelligence Community security policies, Risk Management Framework (RMF) requirements, and federal cybersecurity standards throughout the program life cycle.

Collaborate with application leads, system administrators, database administrators, software developers, and testing teams to integrate security requirements into system design, development, deployment, and maintenance activities.

Provide technical guidance and security compliance expertise to ensure systems are developed with security controls and regulatory requirements incorporated from the outset

Support systems in achieving and maintaining Authorization to Operate (ATO) by identifying compliance gaps, coordinating remediation activities, and maintaining required security documentation.

Plan, coordinate, and support security assessment events, responding to technical inquiries and compliance requirements from Information Systems Security Managers (ISSMs) and Security Control Assessors (SCAs)

Develop, review, update, and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Plans of Action and Milestones (POA&Ms), and other required security authorization documentation using XACTA.

Lead and coordinate Interim Authorization to Test (IATT) and Authorization to Operate (ATO) activities, working closely with cybersecurity teams, system owners, stakeholders, and the Authorizing Official (AO)

Implement, assess, and validate NIST SP 800-53 security controls within cloud-native Data Platform as a Service (DPaaS) environments to ensure compliance with applicable security requirements.

Apply Zero Trust security principles to protect enterprise data services, including identity and access management, network segmentation, access restrictions, and data flow controls.

Evaluate existing IT architectures, system configurations, and security implementations against applicable security frameworks, including ICD 503, to identify deficiencies and recommend corrective actions.

Utilize Splunk and other approved security monitoring tools to review system activity, support security assessments, and identify potential security concerns.

Coordinate with ISSMs, Information Systems Security Engineers (ISSEs), system owners, developers, and government security representatives to resolve compliance issues and support security authorization decisions.

Monitor and track security findings, vulnerabilities, remediation activities, and POA&M milestones to ensure timely resolution and sustained compliance.

Provide cybersecurity expertise, technical recommendations, and security status updates to program leadership, government stakeholders, and engineering teams

Support continuous monitoring activities and ongoing improvements to system security posture, operational resilience, and cybersecurity risk management practices

The Senior ISSO will oversee and support Risk Management Framework (RMF) processes, security assessments, compliance activities, and Authorization to Operate (ATO) efforts throughout the system development life cycle. This position requires extensive expertise in NIST SP 800-53 security controls, ICD 503, XACTA, Zero Trust architecture, and cloud-native security environments. The ideal candidate will demonstrate advanced technical judgment, strong leadership capabilities, and the ability to collaborate with cybersecurity professionals, system owners, developers, and government stakeholders to ensure systems meet applicable security requirements., Due to the sensitivity of customer related requirements, U.S. Citizenship is required.

Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance with an active Counterintelligence (CI) Polygraph is required.

Eighteen (18) years of professional experience in information security, cybersecurity, systems engineering, or a closely related technical field with comparable responsibilities and scope.

Education may substitute for professional experience as follows: A bachelor’s degree may substitute for four (4) years of experience, and a master’s degree may substitute for six (6) years of experience.

DoD 8570/8140 (formerly 8540) certification requirements must be met, including a current CompTIA Security+ certification or another qualifying IAT Level II or III certification, as applicable to the position.

Demonstrated proficiency with XACTA and the Risk Management Framework (RMF), including managing and supporting Interim Authorization to Test (IATT) and Authorization to Operate (ATO) processes

Strong working knowledge of Splunk, including its use in security monitoring, event analysis, and compliance-related activities.

Experience conducting technical security assessments and architecture reviews to evaluate compliance with applicable cybersecurity requirements and security frameworks, including Intelligence Community Directive (ICD) 503

Demonstrated expertise implementing, assessing, and maintaining NIST SP 800-53 security controls within enterprise information systems.

Extensive experience developing, reviewing, and maintaining System Security Plans (SSPs), Security Assessment Plans (SAPs), Plans of Action and Milestones (POA&Ms), and other security assessment and authorization artifacts

Proven ability to coordinate effectively with ISSMs, ISSEs, system owners, Security Control Assessors, and Authorizing Officials to support cybersecurity compliance and authorization requirements.

Strong understanding of information system security principles, risk assessment methodologies, vulnerability management, and continuous monitoring processes

Experience supporting security compliance activities throughout the system development life cycle, including system design, development, testing, deployment, and maintenance.

Demonstrated ability to identify security risks, evaluate technical vulnerabilities, recommend mitigation strategies, and support the implementation of corrective actions.

Excellent analytical, problem-solving, technical documentation, and communication skills, with the ability to explain complex cybersecurity requirements to technical and nontechnical stakeholders.

Ability to work independently, manage competing priorities, and collaborate effectively in a highly technical, mission-focused Intelligence Community environment

Desired Skills:

Previous experience serving as an Information Systems Security Officer (ISSO) or Information Systems Security Engineer (ISSE) supporting government, defense, or Intelligence Community programs.

Demonstrated experience leading cybersecurity initiatives for large-scale or mission-critical programs, including the development and implementation of enterprise security strategies.

Proven leadership experience managing or coordinating cybersecurity professionals, technical teams, and cross-functional security initiatives

Experience supporting cloud-native architectures, Data Platform as a Service (DPaaS) environments, and Zero Trust security implementations

Strong understanding of identity and access management, network segmentation, data protection, and secure information flow controls

Demonstrated success communicating and collaborating with government customers, program managers, executive leadership, system engineers, and cybersecurity stakeholders

Experience providing technical leadership, cybersecurity guidance, and strategic recommendations to improve enterprise security posture and regulatory compliance.