ISSO/ISCM Lead (RFP)

Ampcus, Inc; Washington (District of Columbia); On-site; USD 100,000 - 130,000; Full time

Job summary

Ampcus, Inc is seeking an ISSO/ISCM Lead in Washington, DC, responsible for overseeing the Information Security Continuous Monitoring (ISCM) program. The role involves strategic coordination of compliance, risk management, and documentation oversight. Candidates should have a CISSP or equivalent certification. Key responsibilities include leading internal security assessments, managing the end-to-end lifecycle of security processes, and acting as the primary liaison with the Office of the CISO. This position plays a critical role in maintaining security standards and ensuring effective risk management in line with operational requirements.

Qualifications

• Experience leading compliance and authorization support.
• Proficient in Risk Management Framework (RMF) and A&A lifecycle.
• Ability to coordinate security controls testing and Security Control Assessments (SCA).

Responsibilities

• Lead the execution of the Information Security Continuous Monitoring (ISCM) program.
• Facilitate internal controls testing and manage POA&M lifecycle.
• Coordinate weekly security meetings between business functions and the Office of the CISO.

Skills

CISSP or equivalent information security governance/risk certification

Job description

Job Title: ISSO/ISCM Lead (RFP)

Job Location: Washington, DC

Contractor shall provide an ISSO/ISCM Lead responsible for the strategic coordination of compliance, authorization support, and the comprehensive execution of the Information Security Continuous Monitoring (ISCM) program. This role leads the Risk Management Framework (RMF) and A&A lifecycle, ensuring that all security artifacts, including System Security Plans (SSP), Configuration Management Plans (CMP), and Disaster Recovery Plans (DRP), are continuously maintained and updated to reflect the current operational environment. Beyond documentation oversight, the Lead facilitates proactive internal controls testing and internal Security Control Assessments (SCA) to verify that security controls remain effective over time. They act as the primary liaison between business functions and the Office of the CISO, coordinating weekly security meetings and managing the end-to-end lifecycle of POA&M, risk acceptances, and configuration deviations tracked directly to the system's authorization boundary. Additionally, this individual manages the collection of investigation artifacts for internal and external audits, such as FISMA and OIG, ensuring all evidence meets oversight quality standards.

Certification Stack and copies required.

• ISSO Lead: CISSP or equivalent information security governance/risk certification

Ampcus is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veterans or individuals with disabilities.