> Markdown version of [/jobs/ext/599865-senior-information-system-security-officer-isso](https://www.wearedevelopers.com/jobs/ext/599865-senior-information-system-security-officer-isso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Information System Security Officer (ISSO)

- **Company:** Embedded Alliance, Inc.
- **Location:** Gaithersburg, MD, United States
- **Experience:** Expert
- **Salary:** $145,000.0 - $190,000.0
- **Contract:** Permanent contract
- **Skills:** Xacta, Disaster Recovery, Information Security Management, Zero Trust Network Access, Software Vulnerability Management, Patch Management, Nessus, Splunk, Servicenow, Vulnerability Analysis
- **Published:** June 18, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=70204857cfb03d06

## About the Role

Do you have experience in Vuls?, Do you have a Bachelor's degree?, * Clearance: Active TS/SCI with Polygraph (US Citizenship required).

 * Education & Experience: Bachelor's degree with 8-12 years of relevant cybersecurity/information assurance experience.
 * Framework Expertise: Proven understanding and hands-on application of ICD-503 and the Risk Management Framework (RMF).
 * Technical Toolset: Experience with XACTA/XACTA-360, ACAS, Nessus, and SPLUNK., * Direct experience supporting the National Geospatial-Intelligence Agency (NGA) or broader Intelligence Community (IC).
 * Active CISSP or CISM certification.
 * 3+ years of deep-dive experience analyzing and resolving vulnerability scan results using Tenable Security Center / Nessus.

## Description

* A&A Leadership: Initiate, coordinate, and execute all Risk Management Framework (RMF) and A&A renewal activities in direct coordination with NGA Designated Authorization Officials (DAO/DAOR).
 * Vulnerability Management: Oversee scanning, analysis, and remediation verification across three distinct classification enclaves using Nessus and Tenable-ACAS.
 * Documentation & Records: Develop and maintain critical security artifacts-including System Security Plans (SSPs), Security CONOPS, IT Disaster Recovery (ITDR) plans, and POA&Ms utilizing XACTA-360 and ServiceNow.
 * Cross-Functional Collaboration: Partner with System Engineers, Administrators, Lab Teams, and leadership to drive security process improvements and evaluate secure software/hardware integrations.
 * Incident & Tasking Response: Rapidly address cybersecurity notices, orders, and directives in accordance with NGA vulnerability and patch management processes.
 * Architecture Evaluation: Assess the effectiveness of defense-in-depth architectures and Zero Trust policy implementations against emerging threats.


## Related Videos

- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer)
- [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)