Information System Security Officers (ISSO)

Disruptive Solutions, LLC; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

Disruptive Solutions, LLC is seeking multiple Information System Security Officers (ISSO) to support federal and state cybersecurity programs remotely. The ISSO will manage security posture, authorization status, and RMF documentation for assigned information systems across the lifecycle, collaborating with ISSMs, owners, and security engineers to maintain compliance and risk mitigation.

The role requires strong NIST RMF expertise, experience with SSPs/SAPs/SARs/POA&Ms, and the ability to

Qualifications

• 5–15 years of cybersecurity experience, including ISSO/IA/RMF responsibilities.
• Experience supporting RMF lifecycle for federal information systems.
• Strong knowledge of NIST SP 800-37/53/60, FISMA and FIPS guidance.
• Experience developing and maintaining SSPs, SAPs, SARs, and POA&Ms.
• Ability to translate findings into remediation actions and risk mitigation.

Responsibilities

• Serve as the ISSO for State information systems across the lifecycle.
• Execute and support RMF and system authorization activities.
• Maintain system lifecycle status, authorization status, and risk posture.
• Develop and update RMF artifacts: SSPs, SAPs, SARs, POA&Ms, and plans.
• Coordinate security control implementation evidence with owners and teams.
• Maintain RMF documentation version control and quality.
• Prepare systems for Security Control Assessments and gather evidence.
• Track cybersecurity risks, vulnerabilities, and POA&Ms lifecycle.
• Review findings from Tenable, Wiz, iPost; translate to remediation plans.
• Support continuous monitoring, FISMA metrics, and audits as needed.
• Develop evidence indexes and control implementation statements for security.
• Support cloud/hybrid authorization, including FedRAMP considerations.

Skills

RMF implementation

NIST SP 800-37/53/60

Federal security requirements

Communication skills

Vulnerability management

Education

Bachelor's degree in CS/IT/Cybersecurity or related field

Tools

Tenable

Wiz

iPost

STIGs

GRC platforms

Job description

Information System Security Officers (ISSO)

Information System Security Officers (ISSO)

Location: Remote
Clearance Requirement: Active Secret
Employment Type: Full-Time

About Company

Disruptive Solutions, a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering mission-focused cybersecurity and technology solutions for federal and commercial clients. We specialize in advanced cybersecurity operations, AI/ML integration, cloud modernization, data governance, and risk management. With a proven track record supporting agencies like the Department of Defense (DoD), Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury, we deliver innovative solutions that maximize efficiency and strengthen cyber resilience. At our core, we are dedicated partners committed to securing the mission with innovation, integrity, and measurable impact.

Job Summary

Disruptive Solutions is seeking multiple experienced Information System Security Officers (ISSO) to support cybersecurity and information assurance activities for State. The ISSO will provide hands-on cybersecurity support for assigned information systems throughout the system lifecycle, maintaining visibility into authorization status, security posture, vulnerabilities, and cybersecurity risk. The candidate will work closely with ISSMs, system owners, security engineers, SCAs, technical teams, and other stakeholders to maintain system authorizations and ensure compliance with federal and State cybersecurity requirements.

Key Responsibilities

• Serve as the ISSO for assigned State information systems and support cybersecurity activities throughout the complete system lifecycle.
  
• Execute and support all phases of the NIST Risk Management Framework (RMF) and system authorization process.
  
• Maintain accurate information regarding system lifecycle stage, authorization status, ATO expiration, security controls, vulnerabilities, and overall risk posture.
  
• Develop, maintain, and update RMF and authorization documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), POA&Ms, risk assessments, contingency plans, incident response plans, and supporting security artifacts.
  
• Support system categorization, security control selection and tailoring, inherited controls, control implementation, assessment, authorization, and continuous monitoring activities.
  
• Coordinate with system owners and technical teams to obtain, review, and validate security control implementation evidence.
  
• Maintain version control and quality of RMF documentation and supporting security artifacts.
  
• Prepare systems for independent Security Control Assessments (SCAs), including implementation readiness activities and collection and validation of supporting evidence.
  
• Identify, document, track, and manage cybersecurity risks, vulnerabilities, and remediation activities through the POA&Ms lifecycle.
  
• Review vulnerability and compliance findings from Tenable, Wiz/cloud security platforms, iPost, and comparable security technologies and translate technical findings into risk and remediation activities.
  
• Track vulnerability findings and support remediation in accordance with applicable CISA Binding Operational Directives (BODs), Known Exploited Vulnerabilities (KEV), STIGs, and State requirements.
  
• Support continuous monitoring activities to ensure systems maintain an acceptable security posture and authorization documentation remains current.
  
• Support FISMA metrics, annual FISMA reviews, cybersecurity audits, data calls, and compliance reporting.
  
• Develop and maintain supporting security artifacts such as evidence indexes, inherited control matrices, system boundary and data-flow documentation, and control implementation statements.
  
• Support security requirements for new and existing systems throughout the SDLC and DevSecOps lifecycle.
  
• Support cloud and hybrid system authorization activities, including FedRAMP control inheritance and cloud security requirements.
  
• Participate in cybersecurity risk governance activities and provide recommendations to system owners, ISSMs, security engineers, and other stakeholders.
  
• Support post-incident activities and ensure relevant findings are incorporated into risk assessments, POA&Ms, SSPs, and control implementation statements.
  

Required Qualifications

• 5–15 years of cybersecurity experience, including experience as an ISSO or performing Information Assurance, Assessment & Authorization, RMF, or comparable cybersecurity responsibilities.
  
• Demonstrated experience supporting federal information systems through the RMF and ATO lifecycle.
  
• Strong knowledge of NIST SP 800-37, NIST SP 800-53, NIST SP 800-60, FISMA, and FIPS 199/200.
  
• Experience developing and maintaining SSPs, SAPs, SARs, POA&Ms, risk assessments, and other authorization artifacts.
  
• Experience assessing security controls and validating implementation evidence.
  
• Experience with vulnerability management, remediation tracking, and continuous monitoring.
  
• Experience using enterprise GRC platforms to manage authorization packages, security controls, and POA&Ms.
  
• Ability to interpret vulnerability and compliance results from technologies such as Tenable, Wiz, and other enterprise security platforms.
  
• Understanding of STIGs, CISA KEV, BODs, vulnerability remediation, and configuration compliance.
  
• Strong written and verbal communication skills with the ability to communicate security risks to technical and non-technical stakeholders.
  
• Experience supporting federal cybersecurity environments.
  

Preferred Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Systems, or a related field is preferred. Relevant professional experience may be considered in lieu of a degree based on program requirements.
  

Equal Opportunity Statement

Disruptive Solutions, LLC is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status, sexual orientation, gender identity, or any other characteristic protected by law.