About the role
Position Summary
We are seeking a detail-oriented Information System Security Officer (ISSO) to support the development, maintenance, and continuous monitoring of Authorization to Operate (ATO) packages for Automated Information Systems (AIS). This role is responsible for ensuring systems meet federal cybersecurity and compliance requirements (NIST RMF, FISMA, FedRAMP as applicable) and for coordinating with system owners, engineers, and auditors throughout the authorization lifecycle. Active Top Secret clearance required.
Responsibilities
- RMF & ATO Package Development
- Lead development, update, and maintenance of AIS authorization packages in accordance with NIST Risk Management Framework (RMF).
- Prepare and manage ATO documentation including:
- System Security Plan (SSP)
- Security Assessment Report (SAR)
- Plan of Action & Milestones (POA&M)
- Risk Assessment Report (RAR)
- Continuous Monitoring Strategy
- Interconnection Security Agreements (ISA) and MOUs/MOAs.
- Ensure systems maintain compliance with FISMA, NIST 800-53, NIST 800-37, and agency-specific security requirements.
- Security Control Implementation & Assessment
- Work with technical teams to implement, document, and validate security controls.
- Perform control assessments, gap analyses, and remediation tracking.
- Coordinate and support internal and external security assessments and audits.
- Review vulnerability scan results and ensure timely remediation.
- Continuous Monitoring
- Maintain continuous monitoring activities and update authorization artifacts as required.
- Track and manage POA&Ms to closure.
- Monitor system changes and assess security impact through change management processes.
- Stakeholder Collaboration
- Serve as liaison between system owners, ISSMs, engineers, auditors, and Authorizing Officials.
- Provide security guidance throughout system development lifecycle (SDLC).
- Support risk decisions and provide security recommendations to leadership.
- Compliance & Reporting
- Maintain compliance with federal cybersecurity policies and directives.
- Prepare reports and briefings on system security posture and risk status.
- Ensure proper configuration management and documentation control.