Information Systems Security Officer (ISSO)

MDAEdge; Reston (VA); On-site; USD 150,000 - 190,000; Full time

Job summary

MDAEdge is seeking a Senior Cybersecurity Engineer to serve as a subject matter expert in security compliance and risk management across the program life cycle. The role drives Authorization to Operate (ATO) efforts, implements NIST controls, and collaborates with cross-functional teams to build security into cloud-native and data-focused environments.

This onsite role requires TS/SCI with CI poly, IAT II/III certifications, and extensive RMF/NIST experience.

Qualifications

• 13 years of experience in software/systems engineering or a related field (education substitutions apply: 9 years with a Bachelor's or 7 years with a Master's).
• Active TS/SCI clearance with an active CI Polygraph.
• Current IAT Level II or III certification (e.g., Security+, CISSP, CASP+, or CISM).
• Expert knowledge of XACTA, Splunk, and RMF processes.
• Hands-on experience with ICD 503 and NIST 800-53 security requirements.
• Ability to work full-time onsite in a SCIF with flexible hours.

Responsibilities

• Conduct comprehensive technical security assessments and contribute to the design of secure systems.
• Manage risk and ensure system security compliance through the entire program life cycle.
• Collaborate with application leads, DBAs, developers, and testers to achieve and maintain Authority to Operate (ATO).
• Develop and maintain critical security documentation, including System Security Plans (SSP) and Plans of Action and Milestones (POA&M), using XACTA.
• Lead Interim Authority to Test (IATT) and ATO efforts by coordinating with stakeholders, cyber teams, and Authorizing Officials (AO).
• Implement and validate NIST 800-53 controls within cloud-native Data Platform as a Service (DPaaS) environments.
• Apply Zero Trust principles to secure data services, specifically focusing on identity, segmentation, and flow control.
• Support security assessment events and respond to technical inquiries from ISSMs and Security Control Assessors (SCA).

Skills

XACTA

Splunk

RMF process

NIST 800-53

DIA RMF

Education

Bachelor's degree or higher

Tools

ICD 503

Security+

CISSP

CISM

Job description

Role Summary:

The Senior Cybersecurity Engineer serves as a subject matter expert in ensuring system security compliance and risk management throughout the program life cycle. This role involves driving Authorization to Operate (ATO) efforts, implementing NIST controls, and collaborating with cross-functional teams to build security into cloud-native and data-focused environments.

We have three job locations for this role, you can work from either of your choice:

• Annapolis, MD
• Reston, VA
• Washington, DC

Responsibilities:

• Conduct comprehensive technical security assessments and contribute to the design of secure systems.
• Manage risk and ensure system security compliance through the entire program life cycle.
• Collaborate with application leads, DBAs, developers, and testers to achieve and maintain Authority to Operate (ATO).
• Develop and maintain critical security documentation, including System Security Plans (SSP) and Plans of Action and Milestones (POA&M), using XACTA.
• Lead Interim Authority to Test (IATT) and ATO efforts by coordinating with stakeholders, cyber teams, and Authorizing Officials (AO).
• Implement and validate NIST 800-53 controls within cloud-native Data Platform as a Service (DPaaS) environments.
• Apply Zero Trust principles to secure data services, specifically focusing on identity, segmentation, and flow control.
• Support security assessment events and respond to technical inquiries from ISSMs and Security Control Assessors (SCA).

Required Qualifications & Skills:

• Experience: 13 years of experience in Software/Systems Engineering or a related field (Education substitutions apply: 9 years with a Bachelor's or 7 years with a Master's degree).
• Clearance: Active TS/SCI with an active CI Polygraph.
• Certification: Current IAT Level II or III certification (e.g., Security+, CISSP, CASP+, or CISM).
• Technical Proficiency: Expert knowledge of XACTA, Splunk, and DIA's Risk Management Framework (RMF) process.
• Frameworks: Hands-on experience with ICD 503 and NIST 800-53 security requirements.
• Documentation: Proven ability to create and manage SSPs, SAPs, and POA&Ms.
• Environment: Ability to work full-time onsite in a Sensitive Compartmented Information Facility (SCIF) with flexible hours.

Desired Attributes:

• Prior experience specifically as an ISSO or ISSE on large-scale government programs.
• Demonstrated leadership in guiding cybersecurity teams and managing complex initiatives.
• Strong communication skills with the ability to translate complex technical concepts for leadership and customer stakeholders.