Senior Information System Security Officer / Alternate ISSO

Job Description

Job Description

Senior Information System Security Officer / Alternate ISSO
Location: Washington, DC / Hybrid or off-site as authorized
Security Requirement: Must be eligible for and capable of obtaining and maintaining a Tier 4 High-Risk Public Trust background investigation

Position Overview

The Senior Information System Security Officer will provide senior-level cybersecurity and compliance support for assigned DFC information systems. The Senior ISSO will lead assigned RMF, continuous-monitoring, vulnerability-management, POA&M, audit-readiness, documentation, incident-coordination, and cybersecurity-governance activities.

At least one Senior ISSO will serve as the designated Alternate ISSO and must be fully qualified to assume the Lead ISSO’s responsibilities during scheduled or unscheduled absences without disruption or degradation of services.

Essential Duties and Responsibilities

• Perform senior ISSO responsibilities for assigned systems throughout the system development and authorization lifecycle.
• Support consistent execution of ISSO processes and security requirements across assigned systems.
• Lead assigned RMF and authorization-support activities.
• Develop, review, update, and maintain system authorization packages and supporting cybersecurity documentation.
• Maintain accurate system security information, control implementation details, inherited-control information, security findings, POA&Ms, and supporting evidence in CSAM or other Government-designated repositories.
• Conduct continuous-monitoring reviews and analyze changes in system security posture.
• Review vulnerability scan results, configuration findings, patch status, control deficiencies, account-management data, and related cybersecurity evidence.
• Develop and maintain POA&Ms, coordinate remediation activities, monitor milestones, identify aging or overdue items, and prepare closure evidence.
• Coordinate with System Owners, technical teams, control owners, assessors, and federal cybersecurity personnel to resolve findings and maintain authorization readiness.
• Perform security impact analyses for proposed system, application, infrastructure, cloud, identity, network, or configuration changes.
• Support cybersecurity participation in change advisory boards, configuration control boards, engineering reviews, and technical governance meetings.
• Support incident-response coordination by identifying affected systems, reviewing authorization impacts, documenting corrective actions, and updating required security artifacts.
• Support internal control assessments, audit requests, evidence collection, compliance reviews, and Government cybersecurity data calls.
• Review documentation and evidence for completeness, accuracy, traceability, consistency, and compliance before submission.
• Identify cybersecurity risks, issues, dependencies, and emerging concerns and communicate them promptly to the Lead ISSO.
• Prepare technical status information, performance metrics, risk updates, and supporting material for weekly, monthly, and quarterly reporting.
• Maintain proficiency with DFC cybersecurity and operational tools, including CSAM, ServiceNow, Splunk, and vulnerability-scanning platforms.
• Participate in transition, knowledge-transfer, onboarding, and cross-training activities.
• Maintain sufficient knowledge of Lead ISSO duties to provide continuity when designated as the Alternate.
• Complete all required DFC cybersecurity, privacy, records-management, insider-threat, rules-of-behavior, and role-based training.

Required Qualifications

• Demonstrated experience performing ISSO, cybersecurity compliance, RMF, or security-control activities in a federal or similarly regulated environment.
• Working knowledge of NIST SP 800-37, NIST SP 800-53, FISMA, FedRAMP, continuous monitoring, vulnerability management, and POA&M processes.
• Experience developing or maintaining authorization packages and supporting cybersecurity documentation.
• Experience supporting control assessments, authorization readiness, security findings, remediation activities, and audit evidence.
• Experience with vulnerability scanning, security posture analysis, configuration compliance, security impact analysis, and incident coordination.
• Ability to work directly with System Owners, technical teams, assessors, control owners, and Government cybersecurity officials.
• Strong documentation, analytical, organizational, and communication skills.
• Ability to manage multiple systems and concurrent cybersecurity requirements.
• Ability to assume Lead ISSO responsibilities when designated.
• U.S. citizenship.
• Eligibility to obtain and maintain a Tier 4 High-Risk Public Trust determination.
• Availability to support required Eastern Time coverage.

Desired Education and Certifications

• Bachelor’s degree in cybersecurity, information technology, computer science, information systems, engineering, or a related field.
• CISSP, CGRC/CAP, CISM, Security+, CASP+, or another relevant cybersecurity certification.
• Experience supporting FISMA Moderate systems or federal General Support Systems.
• Experience with CSAM or another federal GRC platform.
• Previous federal ISSO experience.
• Previous Tier 4 Public Trust determination or another current federal investigation potentially eligible for reciprocity.