Information Systems Security Officer (ISSO)

MDAEdge; Washington (District of Columbia); On-site; USD 160,000 - 210,000; Full time

Job summary

MDAEdge is seeking a Senior Cybersecurity Engineer to drive ATO efforts, implement NIST controls, and integrate security across cloud-native and data-focused environments. This role requires collaboration with cross-functional teams and experience in RMF and cloud security.

Locations include Annapolis, MD; Reston, VA; or Washington, DC, with onsite work in an SCIF. The ideal candidate holds TS/SCI with CI Poly, IAT II/III certs, and deep hands-on experience with XACTA and Splunk to secure

Qualifications

• 13 years of Software/Systems Engineering or related field experience (education substitutions apply).
• Active TS/SCI clearance with CI Poly.
• Current IAT Level II or III certification (e.g., Security+, CISSP, CASP+, or CISM).
• Expert knowledge of XACTA, Splunk, and RMF processes.
• Hands-on experience with ICD 503 and NIST 800-53 security requirements.
• Ability to create and manage SSPs, SAPs, and POA&M.
• Ability to work full-time onsite in a SCIF with flexible hours.

Responsibilities

• Conduct comprehensive technical security assessments and contribute to the design of secure systems.
• Manage risk and ensure system security compliance through the entire program life cycle.
• Collaborate with application leads, DBAs, developers, and testers to achieve and maintain Authority to Operate (ATO).
• Develop and maintain critical security documentation, including System Security Plans (SSP) and Plans of Action and Milestones (POA&M), using XACTA.
• Lead Interim Authority to Test (IATT) and ATO efforts by coordinating with stakeholders, cyber teams, and Authorizing Officials (AO).
• Implement and validate NIST 800-53 controls within cloud-native Data Platform as a Service (DPaaS) environments.
• Apply Zero Trust principles to secure data services, specifically focusing on identity, segmentation, and flow control.
• Support security assessment events and respond to technical inquiries from ISSMs and Security Control Assessors (SCA).

Skills

XACTA

Splunk

RMF

NIST 800-53

ICD 503

SSP/POA&M documentation

Security clearance TS/SCI with CI Poly

Job description

Role Summary:

The Senior Cybersecurity Engineer serves as a subject matter expert in ensuring system security compliance and risk management throughout the program life cycle. This role involves driving Authorization to Operate (ATO) efforts, implementing NIST controls, and collaborating with cross-functional teams to build security into cloud-native and data-focused environments.

We have three job locations for this role, you can work from either of your choice:

• Annapolis, MD
• Reston, VA
• Washington, DC

Responsibilities:

• Conduct comprehensive technical security assessments and contribute to the design of secure systems.
• Manage risk and ensure system security compliance through the entire program life cycle.
• Collaborate with application leads, DBAs, developers, and testers to achieve and maintain Authority to Operate (ATO).
• Develop and maintain critical security documentation, including System Security Plans (SSP) and Plans of Action and Milestones (POA&M), using XACTA.
• Lead Interim Authority to Test (IATT) and ATO efforts by coordinating with stakeholders, cyber teams, and Authorizing Officials (AO).
• Implement and validate NIST 800-53 controls within cloud-native Data Platform as a Service (DPaaS) environments.
• Apply Zero Trust principles to secure data services, specifically focusing on identity, segmentation, and flow control.
• Support security assessment events and respond to technical inquiries from ISSMs and Security Control Assessors (SCA).

Required Qualifications & Skills:

• Experience: 13 years of experience in Software/Systems Engineering or a related field (Education substitutions apply: 9 years with a Bachelor's or 7 years with a Master's degree).
• Clearance: Active TS/SCI with an active CI Polygraph.
• Certification: Current IAT Level II or III certification (e.g., Security+, CISSP, CASP+, or CISM).
• Technical Proficiency: Expert knowledge of XACTA, Splunk, and DIA's Risk Management Framework (RMF) process.
• Frameworks: Hands-on experience with ICD 503 and NIST 800-53 security requirements.
• Documentation: Proven ability to create and manage SSPs, SAPs, and POA&Ms.
• Environment: Ability to work full-time onsite in a Sensitive Compartmented Information Facility (SCIF) with flexible hours.

Desired Attributes:

• Prior experience specifically as an ISSO or ISSE on large-scale government programs.
• Demonstrated leadership in guiding cybersecurity teams and managing complex initiatives.
• Strong communication skills with the ability to translate complex technical concepts for leadership and customer stakeholders.