Information Systems Security Officer (ISSO) – Mid/Senior Level
Free account needed to apply or save. It takes a minute, and we'll bring you right back to this job.
How well do you match this job?
Key details
- Location
- United States
- Work style
- Remote
- Level
- Senior
- Job type
- Full-time
- Experience
- 6–9 yrs
- Function
- Security & Protective services
- Focus area
- other
- Posted
- 11h ago
Skills
About the role
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Information Systems Security Officer (ISSO) – Mid/Senior Level based in the United States.
We are seeking an experienced Information Systems Security Officer to support federal programs by strengthening information system security, regulatory compliance, and risk management. In this fully remote role, you will oversee security authorization activities and help ensure systems meet stringent federal cybersecurity requirements. You will lead the development and maintenance of Authority to Operate (ATO) documentation while supporting continuous monitoring and risk mitigation initiatives. Working closely with system engineers and federal stakeholders, you will identify vulnerabilities, assess security controls, and implement effective remediation strategies. This opportunity is ideal for a security professional with strong Risk Management Framework expertise who enjoys managing complex environments and advising clients on security best practices. You will play a key role in maintaining the confidentiality, integrity, and availability of critical federal information systems.
Accountabilities
-
Security Assessment and Authorization: Lead the preparation, development, and maintenance of ATO documentation, including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and supporting security documentation.
-
Risk Management Framework: Guide assigned information systems through the complete ATO lifecycle and continuous authorization processes, ensuring compliance with NIST SP 800-53, FISMA, FedRAMP, and RMF requirements.
-
Risk Assessment and Mitigation: Conduct Security Impact Analyses (SIAs) for system changes, identify security risks, develop remediation strategies, and collaborate with system engineers to maintain secure system configurations and baselines.
-
Compliance and Security Assessments: Perform security self-assessments, risk assessments, and periodic compliance reviews to verify the effectiveness of implemented security controls.
-
Contingency and Incident Response: Coordinate and support annual testing of Contingency Plans and Incident Response Plans to ensure organizational readiness and regulatory compliance.
-
Continuous Monitoring: Review audit logs, analyze vulnerability scan results, and evaluate system-level security reports to identify weaknesses and maintain ongoing security assurance.
-
Technical Security Oversight: Apply knowledge of network security, operating systems, cloud environments, container technologies, and security assessment tools to evaluate and strengthen system security.
-
Multi-System Management: Oversee the security posture and compliance activities of approximately four to six information systems simultaneously.
-
Stakeholder Collaboration: Serve as a trusted security advisor, communicating security findings, compliance requirements, and remediation recommendations clearly to clients and technical teams.
-
Documentation and Reporting: Maintain accurate security records, track remediation activities, and ensure all authorization and compliance documentation remains current and audit-ready.
-
Bachelor's degree in Information Technology, Cybersecurity, or a related discipline.
-
At least 6 years of hands-on professional experience in Information Systems Security Officer (ISSO) or Risk Management Framework (RMF) roles.
-
Direct experience developing and managing federal ATO documentation, including SSPs, POA&Ms, and SARs.
-
Strong working knowledge of NIST SP 800-53, FISMA, FedRAMP, and Risk Management Framework requirements.
-
Demonstrated experience managing the security and compliance activities of multiple information systems, ideally four to six systems concurrently.