ISSO/Control Evaluator – Low

Koniag Services, Inc.; Washington (District of Columbia); On-site; USD 70,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401K with company matching

Flexible spending accounts

Paid holidays

Paid time off

Job summary

Koniag Data Solutions, LLC, a Koniag Government Services company, seeks an ISSO/Control Evaluator to support SBA information systems in Washington, DC. You will assist with RMF lifecycle activities, security documentation, and assessment support under senior staff guidance.

This role offers a comprehensive benefits package and requires the ability to obtain a Public Trust. Ideal for a junior information security professional aiming to grow in federal cybersecurity compliance.

Qualifications

• Bachelor's degree in cybersecurity, information technology, computer science, information assurance, or related field.
• 1–3 years of experience in information security or related field.
• Basic familiarity with RMF process and federal documentation requirements.
• Certifications such as CompTIA Security+, CySA+, GSEC, SSCP, or A+/Network+ (or pursuing).
• 2+ years in information security/Cybersecurity role with RMF exposure.
• Prior internship or project supporting federal government cybersecurity programs.
• Pursuit or possession of CAP/CGRC certification.

Responsibilities

• Support senior ISSO staff in fulfilling ISSO responsibilities for SBA information systems.
• Assist in RMF lifecycle activities including categorization, control selection, and monitoring.
• Develop and maintain SSPs, SARs, POA&Ms, and other ATO artifacts per NIST SP 800-53 and SBA standards.
• Assist with security control assessments and documentation of findings in SARs.
• Maintain POA&Ms and coordinate remediation with system owners and IT teams.
• Support continuous monitoring, vulnerability data collection, and configuration compliance.

Skills

RMF lifecycle knowledge

NIST SP 800-53 familiarity

Security control assessment

Documentation: SSP/SAR/POA&M

Vulnerability management basics

Education

Bachelor's degree in Cybersecurity / IT / CS

Job description

Posted Thursday, July 16, 2026 at 4:00 AM

Koniag Data Solutions, LLC, a Koniag Government Services company, is seeking an ISSO/Control Evaluator – Low to support KDS and our government customer in Washington, DC. This position requires the candidate to be able to obtain a Public Trust.

We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, flexible spending accounts, paid holidays, three weeks paid time off, and more.

Koniag Data Solutions, a Koniag Government Services company, is seeking a motivated and detail-oriented Junior Information Systems Security Officer (ISSO) / Control Evaluator to support the U.S. Small Business Administration (SBA). The ideal candidate is an early‐career information security professional with a foundational understanding of federal information security requirements, security control frameworks, and the NIST Risk Management Framework (RMF). This individual will work under the guidance of senior ISSO and security authorization staff to support the security authorization and continuous monitoring of SBA's information systems, gaining hands‑on experience in federal cybersecurity compliance and security control assessment activities.

The Junior ISSO/Control Evaluator will support the security authorization and continuous monitoring of SBA's information systems under the direction of mid‑level and senior ISSO staff, assisting with security control assessments, security documentation development and maintenance, and day‑to‑day information security support activities.

Principal responsibilities:

• Support senior ISSO staff in fulfilling Information Systems Security Officer responsibilities for assigned SBA information systems, providing day‑to‑day information security assistance and administrative support to system owners, program teams, and IT staff.
• Assist in supporting the NIST Risk Management Framework (RMF) lifecycle for assigned systems, including security categorization, security control selection and tailoring reviews, security control implementation documentation, security control assessment support, and continuous monitoring activities under the direction of senior security staff.
• Assist in the development, maintenance, and updating of security authorization documentation for assigned systems, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), Risk Assessment Reports (RARs), and other ATO package artifacts in accordance with NIST SP 800-53 and SBA security documentation standards.
• Support the conduct of security control assessments for assigned systems, assisting senior assessors in applying NIST SP 800-53A assessment procedures to evaluate the design, implementation, and operational effectiveness of security controls, and contributing to the documentation of assessment findings in Security Assessment Reports (SARs).
• Assist in the development and maintenance of POA&M items for assigned systems, supporting the tracking of identified security weaknesses and compliance deficiencies, coordinating with system owners and IT teams on remediation activities, and maintaining accurate and current POA&M records.
• Support continuous monitoring activities for assigned systems, assisting in the collection, review, and analysis of security control assessment results, vulnerability scan findings, configuration compliance data, and other security‑relevant information to support the assessment of ongoing system security posture.
• Assist in the review and analysis of vulnerability scan results for assigned systems, supporting senior ISSO staff in assessing the severity of identified vulnerabilities, tracking remediation activities, and maintaining accurate vulnerability management records.
• Support the preparation of security authorization packages for assigned systems, assisting in the compilation and quality review of ATO documentation to ensure completeness, accuracy, and alignment with SBA and federal documentation standards.
• Assist system owners, developers, and IT operations teams in understanding and implementing security requirements for assigned systems, providing basic technical guidance and information on NIST SP 800-53 security controls under the supervision of senior ISSO staff.
• Support the review and documentation of proposed system changes and configuration changes for assigned systems, assisting in the assessment of potential security impacts under the guidance of senior security staff.
• Assist in incident response coordination activities for assigned systems, supporting the collection and documentation of security incident information and facilitating communication between system owners and the SOC and incident response team.
• Support the development and maintenance of system‑level security documentation for assigned systems, including configuration management plans, incident response plans, contingency plans, and other system security documentation, ensuring records remain current and accurate.
• Assist in preparing for and supporting third‑party security assessments, OIG audits, and other external evaluations, supporting the collection, organization, and quality review of required evidence and supporting documentation.
• Participate in security training, professional development activities, and knowledge‑sharing sessions to build foundational expertise in federal information security, RMF processes, and ISSO responsibilities.
• Contribute to the continuous improvement of SBA's security authorization and continuous monitoring program by identifying documentation inconsistencies, process inefficiencies, and areas for quality improvement, and communicating observations to senior staff.

Education and Experience

Required

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or a related field from an accredited college or university.
• 1‑3 years of experience in information security, IT, or a related field, with demonstrated exposure to federal information security concepts, NIST frameworks, or security authorization activities.
• Basic familiarity with the NIST Risk Management Framework (RMF) process and federal information security documentation requirements.
• One or more of the following certifications:
  • CompTIA Security+
  • CompTIA CySA+
  • GIAC Security Essentials (GSEC)
  • Systems Security Certified Practitioner (SSCP)
  • CompTIA A+ or Network+ (with demonstrated interest and coursework in cybersecurity)
• 2+ years of experience in an information security, IT, or cybersecurity‑related role, with hands‑on exposure to federal security authorization, RMF documentation, or security control assessment activities.
• Prior internship, academic project, or work experience supporting federal government information security or cybersecurity compliance programs.
• Certified Authorization Professional (CAP) / ISC2 Certified in Governance, Risk and Compliance (CGRC) certification or active pursuit of same.

Required Skills and Competencies

• Strong communication skills in English – both written and oral – with the ability to clearly communicate information security concepts, documentation status, and findings to peers, senior staff, and non‑technical stakeholders under the guidance of senior ISSO personnel.
• Foundational understanding of the NIST Risk Management Framework (RMF) process, including the purpose and activities associated with each step of the RMF lifecycle (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor).
• Basic working knowledge of NIST SP 800‑53 security and privacy controls, including the ability to read and interpret control requirements and assist in the documentation of control implementation descriptions within SSPs and related authorization artifacts.
• Familiarity with federal security authorization documentation types and their purpose, including SSPs, SARs, POA&Ms, RARs, and other ATO package components.
• Basic understanding of federal cybersecurity compliance requirements, including FISMA, OMB Circular A‑130, FIPS 199, FIPS 200, and the role of these requirements in shaping ISSO responsibilities and security authorization activities.
• Foundational knowledge of vulnerability management concepts, including an understanding of common vulnerability scoring systems (CVSS) and the ability to assist in the review and interpretation of vulnerability scan results under senior staff guidance.
• Basic familiarity with continuous monitoring concepts and the role of ongoing security assessments, vulnerability scanning, and configuration compliance monitoring in maintaining the security posture of federal information systems.
• Strong attention to detail and organizational skills, with the ability to assist in managing multiple documentation and administrative tasks across assigned systems accurately and efficiently.
• Demonstrated ability and willingness to work collaboratively under the direction of senior staff in a team‑oriented environment, actively seeking guidance and applying feedback to improve work quality and professional growth.
• Basic familiarity with common IT concepts, including networking fundamentals, operating systems, and application security, as they relate to the implementation and assessment of security controls.
• Strong work ethic, intellectual curiosity, and commitment to continuous learning and professional development in the field of federal information security and cybersecurity compliance.
• Ability to obtain and maintain a Public Trust Clearance.

Desired Skills and Competencies

• Prior experience or academic coursework related to federal information security, NIST RMF, security control frameworks, or cybersecurity compliance, demonstrating a foundational understanding of federal security authorization concepts and processes.
• Familiarity with cloud computing concepts and basic cloud security principles, including an awareness of the security implications of cloud service adoption and FedRAMP authorization requirements within federal environments.
• Basic familiarity with GRC platforms and tools used for managing RMF documentation and POA&M tracking within federal environments, such as CSAM, Archer, or ServiceNow GRC.
• Knowledge of privacy control requirements and their relationship to ISSO responsibilities, including a basic understanding of NIST SP 800‑53 privacy controls and federal privacy laws and guidance.
• Familiarity with the CDM (Continuous Diagnostics and Mitigation) program and its role in supporting continuous monitoring and cybersecurity compliance activities within federal civilian agencies.
• Basic scripting or automation skills, such as familiarity with Python or PowerShell, with an interest in applying automation to improve the efficiency of security documentation and assessment support activities.
• Familiarity with Agile and DevSecOps methodologies and an awareness of their implications for security authorization and ISSO responsibilities within iterative software development environments.
• Demonstrated interest in pursuing advanced cybersecurity certifications, such as the Certified Authorization Professional (CAP)/CGRC, CISSP, or CISM, as part of a long‑term professional development plan.
• Experience using Microsoft Office Suite tools, including Word, Excel, and PowerPoint, to develop, maintain, and present security documentation and program reports effectively.
• Participation in cybersecurity competitions, academic research, professional associations, or other extracurricular activities demonstrating a genuine passion for information security and a commitment to professional growth in the field.

Our Equal Employment Opportunity Policy

The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race, color, religion, creed, ethnicity, sex, sexual orientation, gender or gender identity (except where gender is a bona fide occupational qualification), national origin or ancestry, age, disability, citizenship, military/veteran status, marital status, genetic information or any other characteristic protected by applicable federal, state, or local law. We are committed to equal employment opportunity in all decisions related to employment, promotion, wages, benefits, and all other privileges, terms, and conditions of employment.

The company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or apply for a position on our website, please get in touch with Heaven Wood via e‑mail at [e-mail] or by calling 703‑488‑9377 to request accommodations.

Equal Opportunity Employer/Veterans/Disabled Shareholder Preference in accordance with Public Law 88‑352

Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions, Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag, we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical, professional, and operational solutions. KGS enables successful mission outcomes for our customers through solution‑oriented business partnerships and a commitment to exceptional service delivery. We ensure long‑term success with a continuous improvement approach while balancing the collective interests of our customers, employees, and native communities. For more information, please visit www.koniag-gs.com.