Information Systems Security Officer

GovCIO is currently hiring for a Senior Information Systems Security Officer (ISSO) to support our client's contract needs. The Senior ISSO conducts Assessment and Authorization (A&A) activities with responsibility for the full RMF lifecycle from initial categorization through continuous monitoring. This role requires demonstrated expertise managing complex, concurrent assessments — including emerging technology systems such as AI/ML platforms — operating under NIST SP 800-53 Rev 5, CNSSI 1253, and applicable policies. The Senior ISSO provides mentorship to junior ISSO staff.

This position is based in Washington, DC and is eligible for 100% remote work.

Responsibilities

Support and execute all phases of the NIST SP 800-37 RMF lifecycle including categorization, control selection, implementation, assessment, authorization, and continuous monitoring across multiple concurrent systems and network environments

Develop, maintain, and update RMF documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Security Assessment Plans (SAPs), POA&Ms, Contingency Plans, Incident Response Plans, Risk Assessment documentation, and interconnection agreements

Conduct multiple concurrent RMF assessments simultaneously, maintaining compliance documentation in JCAM

Assess and authorize emerging technology systems — including AI/ML platforms and microservices-based architectures — adapting NIST SP 800-53 Rev 5 control baselines to novel system types where standard guidance requires augmentation

Manage evidence collection, control traceability documentation, and Body of Evidence (BOE) packages for assessments, audits, and compliance reviews

Establish system impact levels following FIPS 199 for confidentiality, integrity, and availability; conduct and document Privacy Impact Assessments (PIAs) and Privacy Threshold Analyses (PTAs)

Review and analyze vulnerability results using Tenable Security Center; create, track, and manage POA&M remediation activities through closure; validate scan completeness before Security Control Assessor review

Provide security reporting, dashboards, and status updates to system owners and stakeholders; support development and maintenance of security metrics and scorecard reporting

Ensure systems comply with FISMA, NIST SP 800-53 Rev 5, CNSSI 1253, OMB A-130, and applicable client cybersecurity policies

Manage assessment workflow and task tracking using JIRA; maintain accurate status visibility across multiple concurrent assessment pipelines

Mentor junior ISSO staff; develop SOPs, work instructions, and process documentation to improve team efficiency and assessment quality

Collaborate with technical and non-technical personnel to review systems, gather evidence, and communicate security requirements to system owners and program leadership

Qualifications

Bachelor's with 12+ years of information system security experience (or commensurate experience)

8–10+ years in an ISSO or cybersecurity compliance role, with direct responsibility as ISSO of record on assigned systems

Demonstrated experience conducting RMF assessments across multiple network environments

Experience managing multiple concurrent A&A assessments simultaneously

Experience developing and maintaining complete RMF artifact packages: SSPs, SARs, POA&Ms, RAR, and supporting BOE documentation

Experience with microservices-based or distributed system architectures and component-level security assessments

Proficiency with GRC platforms for A&A documentation and continuous monitoring (JCAM/CSAM, Xacta, or equivalent)

Active CompTIA Security+ CE certification

DoD 8570.01-M / DoD 8140 compliant — IAM Level II or III (CISSP, CISM, CASP+, or equivalent)

Clearance Required: Ability to maintain a Public Trust clearance

Posted Salary Range

USD $143,230.00 - USD $175,000.00 /Yr.