Principal Information System Security Officer

The ISSO supports the ISSM and owns the authorization documentation for this platform at the unclassified (CUI) classification level, across every development team on it. The ISSO works with all teams and consolidates their goals and priorities into a single authorization package covering the entire platform. The role centers on establishing and maintaining ATO packages and their associated artifacts, maintaining interconnection agreements, and transitioning the package from NIST SP 800-53 Rev 4 to Rev 5. Initial scope is the unclassified (CUI) system only. This is a hybrid position with an expected 3-4 days onsite. It will require a counterintelligence polygraph upon hiring if not already attained.

Responsibilities

Owns and maintains the authorization package and its body of evidence (BoE), including the SSP, control statement responses, and supporting artifacts; Executes the package transition from NIST SP 800-53 Rev 4 to Rev 5 in coordination with the ISSM; Develops and maintains interconnection and boundary documentation, including ISAs and related agreements; Owns POA&M entries and milestone tracking, coordinating with security engineers and development teams; Prepares ConMon documentation and reporting on schedule and ensures findings are accurately captured in the package; Maintains the SBOM and component version representation in the package, and validates components against CVE data and mitigation guidance; Participates in the CCB, documenting the authorization impact of proposed changes and filling in for the project ISSM on the unclassified system when the ISSM is unavailable; Coordinates with security engineers, development teams, SCAs, AO staff, and government counterparts on documentation requests and findings; Drafts risk acceptance and deviation documentation when assigned by the ISSM; Identifies project-specific security training and awareness gaps in coordination with the ISSM; Supports security authorization activities in compliance with RMF, DoDI 8510.01, and related DoD processes; Provides surge support and backfill for ISSOs of other environments, including leave coverage, as clearance and access allow

Requirements

U.S. citizen able to obtain and maintain a TS/SCI clearance with CI polygraph; Current DoD 8570.01-M IAM Level II or III certification; 5 or more years of relevant experience developing and maintaining RMF authorization packages (7 or more preferred); Working knowledge of RMF, NIST SP 800-37, NIST SP 800-53 (Rev 4 and Rev 5), NIST SP 800-53B, NIST SP 800-60, and DoDI 8510.01; Experience maintaining the BoE, control statements, and POA&Ms in eMASS; Experience writing or maintaining ISAs or other interconnection agreements (NIST SP 800-47 Rev 1); Understanding of network flows and architecture, especially cloud (Azure and AWS), on-premises, and hybrid environments; Ability to context switch across multiple teams with differing goals and priorities, and to consolidate them into one coherent authorization package; Familiarity with auditing and control assessments, including working with SCAs; Familiarity with the SDLC and with working across multiple Agile or DevSecOps development teams; Knowledge of government security requirements for unclassified and CUI systems; Strong written and verbal communication skills; Ability to work independently with engineering and government stakeholders; Bachelor's degree in Computer Science, Cybersecurity, or a related technical discipline. No experience equivalency applies.

Nice to have

Active TS/SCI clearance with CI polygraph; Experience migrating an authorization package from NIST SP 800-53 Rev 4 to Rev 5; Experience taking a package from creation to full ATO; Experience with classified system authorization (for example CNSSI 1253 overlays); Experience reading and interpreting vulnerability scan results to support CVE validation and POA&M entries; Experience mentoring junior teammates

Benefits

Performance-based bonuses; Extensive medical, dental, and vision coverage; 401(k) plan with company match; Substantial paid time off and holidays; Flexible work arrangements where possible; Range of income protection benefits; Resources supporting professional growth