Information System Security Officer (ISSO)

PD Inc; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

PD Inc. is seeking a Senior ISSO to provide senior-level, hands-on cybersecurity support for federal information systems. You will work with the Lead ISSO and stakeholders to maintain authorization artifacts, review controls, and support government reviews across enterprise and cloud environments.

Candidates with RMF/ISSO experience and Microsoft security certifications are highly preferred. U.S. citizenship and eligibility for a Tier 4 background investigation are required.

Qualifications

• Experience supporting cybersecurity, information assurance, or ISSO activities in a federal environment.
• Hands-on experience with FISMA, NIST RMF, NIST SP 800-53, FedRAMP, ATO packages, SSPs, continuous monitoring, vulnerability management, and POA&M management.
• Experience supporting FISMA Moderate systems, major applications, general support systems, or FedRAMP-authorized cloud services.
• Working familiarity with cybersecurity tools and platforms such as CSAM, ServiceNow, Splunk, Tenable Nessus or Qualys, Microsoft Defender, Azure, Microsoft 365, Entra ID, Intune, Okta, Palo Alto, and Zscaler.
• Strong technical writing, documentation, risk analysis, and stakeholder communication skills.
• Must be a U.S. Citizen
• Must be eligible to successfully complete and maintain a Tier 4 background investigation.

Responsibilities

• Provide senior-level, hands-on cybersecurity support for assigned federal information systems and assume Lead ISSO responsibilities when needed.
• Support RMF, authorization, continuous monitoring, vulnerability management, POA&M management, audit readiness, and cybersecurity compliance across enterprise and cloud environments.
• Develop and maintain authorization artifacts, review security controls and evidence, and support Government cybersecurity reviews and audits.
• Collaborate with Lead ISSO, Government ISSM, system owners, technical teams, assessors, and other stakeholders to maintain system security posture.

Skills

RMF Compliance

NIST SP 800-53

FedRAMP Expertise

Vulnerability Management

Audit Readiness

Technical Writing

US Citizenship

Background Investigation

Tools

CSAM

ServiceNow

Splunk

Nessus

Qualys

Microsoft Defender

Azure

Microsoft 365

Entra ID

Intune

Okta

Palo Alto

Zscaler

Job description

The ISSO will provide senior-level, hands‑on cybersecurity support for assigned federal information systems and will be qualified to assume Lead ISSO responsibilities during scheduled or unscheduled absences. The position will support Risk Management Framework (RMF), authorization, continuous monitoring, vulnerability management, POA&M management, audit readiness, and cybersecurity compliance activities across enterprise and cloud environments.

The Senior ISSO will work closely with the Lead ISSO, Government ISSM, System Owners, technical teams, assessors, and other cybersecurity stakeholders to maintain system security posture, develop and maintain authorization artifacts, track remediation activities, review security controls and evidence, and support Government cybersecurity reviews and audits.

Candidates with a combination of federal RMF/ISSO experience, a recognized cybersecurity certification, and Microsoft security certifications will be strongly preferred.

Required / Strongly Desired Qualifications

• Experience supporting cybersecurity, information assurance, or ISSO activities in a federal environment
• Hands-on experience with FISMA, NIST RMF, NIST SP 800-53, FedRAMP, ATO packages, SSPs, continuous monitoring, vulnerability management, and POA&M management
• Experience supporting FISMA Moderate systems, major applications, general support systems, or FedRAMP-authorized cloud services
• Working familiarity with cybersecurity tools and platforms such as CSAM, ServiceNow, Splunk, Tenable Nessus or Qualys, Microsoft Defender, Azure, Microsoft 365, Entra ID, Intune, Okta, Palo Alto, and Zscaler
• Strong technical writing, documentation, risk analysis, and stakeholder communication skills
• Must be a U.S. Citizen
• Must be eligible to successfully complete and maintain a Tier 4 background investigation

Microsoft Certifications

One or more Microsoft security certifications is required

• SC-500 – Microsoft Certified: Cloud and AI Security Engineer Associate
• SC-300 – Microsoft Certified: Identity and Access Administrator Associate
• SC-200 – Microsoft Certified: Security Operations Analyst Associate
• SC-100 – Microsoft Certified: Cybersecurity Architect Expert
• Other relevant Microsoft Azure, Microsoft 365, security, identity, or compliance certifications

Cybersecurity Certifications

One or more of the following is highly desirable:

• CISSP
• CompTIA Security+
• CISM
• CGRC / CAP
• CCSP
• Similar recognized cybersecurity or information assurance certification

Corporate Resources

Unlike traditional ISSO positions that are primarily compliance and documentation focused, this role is backed by a broader cybersecurity and engineering organization. You will have access to a large cybersecurity laboratory environment, engineering resources, and reach-back subject matter experts across cloud, networking, identity, systems engineering, application security, vulnerability management, security operations, and federal cybersecurity compliance.

You will be able to use these resources to investigate technical issues, validate security approaches, reproduce and assess configurations, evaluate emerging technologies, and develop practical solutions to security and compliance challenges. The position offers an opportunity to lead not only the execution of RMF activities, but also to help shape the technical approaches, processes, tools and practices used by the cybersecurity team.

Technical Environment and Professional Resources

You will be supported by capabilities beyond those normally available to an embedded ISSO team, including:

• Access to a dedicated cybersecurity and engineering laboratory for testing, validation, prototyping, and technical investigation
• Reach-back access to experienced cybersecurity, cloud, network, systems, identity, application, and infrastructure SMEs
• Opportunities to work directly with engineers to translate security findings and control requirements into implementable technical solutions
• Ability to evaluate and test security tools, configurations, architectures, and remediation approaches outside of the production environment
• Access to organizational lessons learned, technical expertise, reusable engineering approaches, and cybersecurity research developed across other federal programs
• Opportunity to help mature the team's RMF, continuous monitoring, vulnerability management, security engineering, and automation practices
• Ability to influence the technical direction and operating model of a growing federal cybersecurity team