Information System Security Officer – Federal Programs

This is a fully remote position, open to applicants in Arizona, +25 more states.

📋 Description

• Act as the designated Information System Security Officer (ISSO) for assigned federal systems and serve as the primary security liaison at the system level.

• Execute the priorities set by the Chief Information Officer (CIO) and Information System Security Manager (ISSM), while escalating program-level issues, risk acceptances, and exceptions.

• Collaborate with Project Managers to integrate security and authorization milestones within project plans.

• Evaluate the security implications of system modifications prior to their release.

• Manage the NIST Risk Management Framework Security Assessment and Authorization lifecycle, beginning with FIPS 199 categorization through to authorization, ongoing authorization, and reauthorization.

• Develop and maintain System Security Plans (SSPs), risk assessments, Privacy Impact Assessments, contingency plans, incident response plans, configuration management plans, and interconnection agreements.

• Oversee the Plan of Action and Milestones (POA&Ms) within the agency's Governance, Risk, and Compliance (GRC) platforms.

• Analyze vulnerability and configuration scans in accordance with DISA STIGs, CIS benchmarks, and agency-specific baselines.

• Assign and monitor remediation efforts in collaboration with Cybersecurity Engineers and IT Operations.

• Generate ongoing authorization and continuous monitoring reports.

• Lead the preparation for assessments from CMS, VA, DoD, and IRS agencies.

• Coordinate the collection of evidence and responses to findings with Compliance Analysts.

• Ensure compliance with federal security, privacy, and Controlled Unclassified Information (CUI) requirements specific to the agency.

• Address security and privacy incidents impacting federal data and manage agency notifications accordingly.

• Fulfill system-level contract security deliverables.

• Oversee federal personnel security responsibilities, such as Public Trust, e-QIP processing, training, rules of behavior, and access attestations.

• Assist with internal audits and control assessments based on SOC 2, NIST, HIPAA, HITRUST, and ISO/IEC 27001 frameworks.

• Provide system-specific insights for external audits and security questionnaires.

⛳️ Requirements

• A minimum of 5 years of experience in information assurance or cybersecurity.

• At least 3 years of experience as an ISSO or Assessment and Authorization (A&A) lead for federal information systems.

• Bachelor's degree in a related discipline or equivalent experience.

• Experience personally guiding at least one federal system through its initial Authorization to Operate (ATO) or reauthorization under NIST SP 800-37/800-53.

• Proven authorship of SSPs and management of POA&Ms in agency-specific GRC platforms.

• Proficient understanding of at least two of the following: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publication 1075 & 4812, DHS 4300A.

• Experience with FedRAMP and HIPAA is advantageous.

• Familiarity with interpreting vulnerability and configuration scan outputs from Tenable/Nessus, Defender, AWS Inspector, or SCAP/STIG Viewer.

• Knowledge of AWS and Microsoft 365/Azure is expected.

• Strong writing skills and the ability to manage multiple systems and deadlines effectively.

• CompTIA Security+ or a higher DoD 8140-qualifying certification is mandatory.

• CISSP, CGRC, CISA, or CCSP certifications are preferred.

• U.S. citizenship is required.

• Must be able to obtain and maintain federal Public Trust suitability.

• Capability to sit, read, work on a computer, and view a computer screen for extended periods.

• Ability to occasionally stand, walk, use hands and fingers, kneel, or crouch is necessary.

🏝️ Benefits

• Flexible remote work arrangement.

• Expected travel of approximately 15–25%.

• Reasonable accommodations provided for individuals with disabilities.

• Participation in on-call coverage for security incidents.

• Commitment to equal employment opportunity and nondiscrimination.

• Acceptance of remote candidates in specified states.