ISSO: Federal Cybersecurity & RMF Expert (Hybrid)

DANASTAR Professional Services, LLC; Washington (District of Columbia); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Eastbay Systems, LLC is seeking an Information Systems Security Officer (ISSO) to support federal cybersecurity programs, combining FISMA/RMF experience with hands-on GRC expertise and understanding of system security architectures.

The ISSO will work with security engineers, SOC analysts, and system owners to assess risks, validate controls, monitor posture, and coordinate remediation across cloud, on-prem, and DevSecOps environments.

Qualifications

• Experience in ISSO or technical GRC roles supporting federal programs.
• Strong knowledge of FISMA, RMF, and NIST SP 800-53 controls.
• Ability to analyze security findings and coordinate remediation.
• Excellent written and verbal communication.

Responsibilities

• Manage FISMA/RMF compliance activities and POA&Ms.
• Execute ISCM activities including control assessments and vulnerability tracking.
• Evaluate system security architectures and controls.
• Define logging/monitoring requirements with the SOC.
• Review user access and privileged accounts.
• Assess PPS baselines and identify security risks.
• Collaborate with security engineering, SOC, cloud, and DevSecOps teams.
• Support FedRAMP oversight, audits, and compliance reporting.

Skills

GRC experience

Continuous monitoring

FISMA/NIST RMF knowledge

Security communications

Education

Bachelor's degree or equivalent in Cybersecurity/CS/IT

Tools

SIEM

Vulnerability scanners

GRC platforms

Job description

Eastbay Systems, LLC is seeking an Information Systems Security Officer (ISSO) to support federal cybersecurity programs, combining FISMA/RMF experience with hands-on GRC expertise and understanding of system security architectures.

The ISSO will work with security engineers, SOC analysts, and system owners to assess risks, validate controls, monitor posture, and coordinate remediation across cloud, on-prem, and DevSecOps environments.