Information System Security Officer (ISSO)

Arch Systems is seeking an experienced Information System Security Officer (ISSO) to support Federal Government programs. The ideal candidate will have extensive experience leading Assessment & Authorization (ATO) efforts, implementing the NIST Risk Management Framework (RMF), and ensuring continuous compliance for cloud and on-premise federal systems. The ISSO will work closely with Government stakeholders, system owners, architects, developers, and operations teams to obtain and maintain ATOs while ensuring compliance with federal cybersecurity requirements., * Lead the complete ATO/RMF lifecycle (Initial ATO, ATO Renewal, Continuous Monitoring).

• Develop and maintain RMF documentation, including SSP, SAP, SAR, POA&M, Contingency Plans, Security Policies, Risk Assessments, and Security Impact Analyses.
• Manage and maintain A&A packages using eMASS, CSAM, Xacta, or similar GRC tools.
• Conduct security control assessments and ensure compliance with NIST SP 800-53 Rev. 5, NIST RMF, FISMA, FedRAMP, CISA guidance, and agency security policies.
• Coordinate vulnerability management, POA&M remediation, STIG compliance, patch management, and continuous monitoring activities.
• Support security audits, annual assessments, penetration testing, and ATO renewals.
• Collaborate with engineering teams to implement secure cloud architectures in AWS and Azure Government environments.
• Provide cybersecurity guidance throughout the System Development Life Cycle (SDLC) and support secure DevSecOps practices.
• Prepare executive-level security reports, risk assessments, and compliance status updates.

Clearance: Ability to obtain and maintain a Public Trust, Secret, or Top-Secret clearance, as required., * Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).

• 7+ years of Federal ISSO experience supporting civilian or DoD agencies.
• Demonstrated experience obtaining and maintaining Authority to Operate (ATO) for federal systems.
• Strong experience with NIST RMF, NIST SP 800-53 Rev. 5, FISMA, FedRAMP, and Continuous Monitoring.
• Hands-on experience with eMASS, CSAM, Xacta, or equivalent A&A platforms.
• Experience managing POA&Ms, vulnerability remediation, security assessments, and audit support.
• Working knowledge of AWS and/or Azure Government cloud security.
• Excellent communication, documentation, and stakeholder management skills., * Experience supporting DHS, HHS, DOL, DoD, VA, Treasury, DOJ, or other Federal agencies.
• Knowledge of Zero Trust Architecture, OSCAL, C-SCRM, DevSecOps, Kubernetes, and AI security governance.
• Experience with security tools such as Tenable, Nessus, Qualys, Microsoft Defender, Microsoft Sentinel, Splunk, AWS Security Hub, GuardDuty, and Azure Defender.

Preferred Certifications One or more of the following:

• CISSP (Preferred)
• CAP (Certified Authorization Professional)
• CISM
• Security+
• CASP+
• CCSP
• AWS Security Specialty
• Azure Security Engineer Associate