Information Systems Security Officer (ISSO) - Surge Support

Quantum Sky; Washington (District of Columbia); On-site; USD 120,000 - 160,000; Full time

Job summary

Quantum Sky seeks a Senior Information Systems Security Officer (ISSO) to support a 1-year surge for a federal customer in Washington, DC. You will lead RMF lifecycle activities, develop security packages, and act as a trusted advisor to CORs and stakeholders while ensuring compliance with privacy and federal requirements.

The role requires strong communication skills, ownership, and the ability to drive complex security and privacy initiatives to completion in a fast-paced government

Qualifications

• 8+ years of professional experience, 5+ years supporting ISSO RMF activities.
• Bachelor’s Degree or 4 years of additional experience in lieu of a degree.
• High school diploma with 8 years of experience substituted for a Bachelor’s Degree.

Responsibilities

• Lead RMF lifecycle activities including ATO, continuous monitoring, and integration of security, privacy, and legal requirements.
• Develop and present security authorization packages and supporting documentation per NIST SP 800-53 and client requirements.
• Own security and privacy initiatives from planning to completion, driving remediation actions and ensuring timely deliverables.
• Conduct security and privacy risk assessments, analyze vulnerability findings, and support continuous monitoring across apps, infra, and databases.
• Advise CORs, system owners, stakeholders, and technical teams on security and privacy requirements clearly and professionally.
• Coordinate contingency planning, incident response, privacy, and continuity activities across the SDLC.

Skills

RMF leadership

stakeholder comms

privacy by design

documentation

Education

Bachelor's degree or 4 years experience

Tools

Nessus

Qualys

ServiceNow

FedRAMP

Job description

Quantum Sky is searching for a Senior Information Systems Security Officer (ISSO) to support a 1 year surge effort for a federal customer in Washington, DC. We are looking for a highly organized, proactive, and customer-focused cybersecurity professional who excels at building trusted relationships, communicating with both technical and executive stakeholders, and independently driving complex initiatives to successful completion.

The ideal candidate thrives in a fast-paced environment, embraces ownership and accountability, and consistently delivers high-quality work while balancing customer needs with federal security and privacy requirements. In this role, you will serve as a trusted advisor to government customers while leading information security, privacy, and Governance, Risk, and Compliance (GRC) activities to ensure federal systems remain secure, compliant, and mission-ready.

Responsibilities:

• Lead and support information system security responsibilities throughout the Risk Management Framework (RMF) lifecycle, including Authorization to Operate (ATO), continuous monitoring, and integration of security, privacy, and legal requirements.
• Develop, maintain, and present security authorization packages and supporting documentation in accordance with client requirements and NIST SP 800-53, including SSPPs, RARs, SAPs, SARs, POA&Ms, contingency and incident response plans, SOPs, configuration management plans, STIG deviations, and related artifacts.
• Own security and privacy initiatives from planning through completion by proactively managing tasks, driving remediation efforts, validating corrective actions, and ensuring deliverables are completed accurately and on schedule.
• Perform security and privacy risk assessments, analyze vulnerability scan results, recommend risk-based solutions, and support continuous monitoring activities across applications, infrastructure, and databases.
• Serve as a trusted cybersecurity advisor to Contracting Officer Representatives (CORs), system owners, business stakeholders, and technical teams by communicating complex security and privacy requirements clearly, professionally, and with a customer-focused approach.
• Develop, coordinate, test, and maintain contingency planning, incident response, privacy, and continuity activities, including PTAs, PIAs, HVA support, privacy training, and privacy-by-design integration throughout the System Development Life Cycle (SDLC).
• Develop and maintain privacy policies, directives, SOPs, and operational guidance while ensuring compliance with applicable federal privacy laws, OMB guidance, NIST publications, CJIS Security Policy, and Legislative Branch requirements.
• Build strong cross-functional relationships while managing multiple concurrent priorities in a fast-paced environment, identifying process improvements, and maintaining exceptional attention to detail across all security and compliance activities.
• Coordinate with internal and external stakeholders to support audits, agency data calls, reporting requirements, asset inventories, and other compliance initiatives.

Required:

• 8+ years of professional experience with at least 5 years supporting ISSO RMF activities.
• Bachelor’s Degree or 4 years of additional experience in lieu of a degree.
• High school diploma with 8 years of experience in Functional Responsibility area may be substituted for a Bachelor’s Degree
• PMP, ISO 27001, or CISM certifications equate to 3 years of experience in Functional Responsibility each
• ITIL, CISSP, or other relevant IT management certifications equate to 2 years of general experience each
• Knowledge of and proficiency in federal government privacy programs, including the Privacy Act of 1974, the E-Government Act of 2002, and related federal privacy laws and regulations.
• Demonstrated understanding of information privacy principles, including information access, release of information, and implementation of privacy controls for electronic and non-electronic information.
• Experience supporting Cybersecurity Awareness Training (CSAT) privacy initiatives, including training development, effectiveness evaluation, and privacy awareness programs.
• Experience with HR privacy and behavioral privacy considerations related to workforce data and monitoring activities.
• Thorough knowledge of FISMA, NIST RMF, Security and Privacy Assessment & Authorization (SPA&A), NIST publications, OMB circulars and memoranda, and CNSS guidance.
• Strong written and verbal communication skills with experience developing technical documentation, presenting complex security and privacy concepts to technical and non-technical audiences, and building trusted relationships with Contracting Officer Representatives (CORs), government leadership, and cross-functional stakeholders.
• Demonstrated ability to lead end-to-end security and compliance initiatives by proactively managing competing priorities, driving deliverables to completion, and exercising sound judgment in a fast-paced, customer-focused environment.
• Highly organized, detail-oriented, and self-motivated with strong analytical and critical thinking skills, a commitment to producing audit-ready documentation, and the ability to identify process improvements while balancing customer service with regulatory compliance.
• CRISC, CAP, CISSP, or equivalent
• Experience with FedRAMP and cloud service providers
• Experience with CSAM and ServiceNow
• Experience with vulnerability assessment tools such as Nessus and/or Qualys
• Policy writing background is highly preferred

Clearance:

• US Citizen with Public Trust eligibility required

Location:

• On-site in DC, minimal remote flexibility