ISSO Jr

Dunhill Professional Search & Government Solutions; Ashburn (VA); On-site; USD 120,000 - 144,000; Full time

Job summary

Dunhill Professional Search & Government Solutions in Ashburn, VA is seeking an Information Systems Security Officer (ISSO) to support federal programs and ensure compliance with FISMA and RMF for major applications and GSSs. The role is on-site, requiring US citizenship and ability to pass a federal background check.

The ISSO will lead security controls, prepare authorization packages, support audits, and guide risk remediation in accordance with NIST SP 800-37 Rev. 2 and agency policies.

Qualifications

• Bachelor's degree in Computer Science or related field or equivalent experience.
• Minimum 3 years of information security experience on programs of comparable scope and complexity.
• Solid knowledge of FISMA, NIST and the RMF methodology.
• Experience with security authorization processes (C&A and ATO) and related documentation.
• Strong understanding of security tools, hardware/software security implementation, and encryption techniques.
• Proven ability to analyze security vulnerabilities and develop remediation instructions.
• Excellent written and verbal communication skills for technical and executive audiences.
• Ability to work on site in Ashburn, VA (no telework).
• US Citizenship (no dual citizenship) and ability to pass a federal background investigation.

Responsibilities

• Serve as SME and point of contact for security requirements on FISMA systems.
• Prepare and maintain System Security Plans, Interconnection Security Agreements, Contingency Plans, POA&Ms, waivers and exceptions.
• Ensure systems are operated and disposed of per NIST RMF and agency policy.
• Conduct periodic security management activities and monthly audit log reviews.
• Document weaknesses as POA&Ms and track corrective actions.
• Support risk acceptance, waiver requests, and access reviews with justification.
• Investigate and report security incidents and coordinate remediation.
• Review PTAs and PIAs and provide security feedback to owners.
• Lead materials for assessment, authorization, audits and vulnerability reviews.
• Assist transition to and maintenance of an OA program for assigned systems.

Skills

RMF/NIST knowledge

FISMA compliance

Security authorization

Vulnerability analysis

Communication skills

On-site work

US Citizenship

Education

Bachelor's degree in Computer Science or related field

Tools

Security tools

Job description

On site in Ashburn, VA — Monday through Friday, 8:30am to 5:00pm

The Information Systems Security Officer (ISSO) supports the overall information security posture of assigned Major Applications (MAs) and General Support Systems (GSSs) for a large federal agency. You will serve as the subject-matter expert and principal point of contact for all system security requirements on assigned FISMA systems, providing expert guidance and leadership in implementing, maintaining and enforcing information security policies, standards and methodologies in accordance with federal regulations and agency requirements.

Responsibilities:

• Serve as the subject-matter expert and principal point of contact for security requirements on assigned FISMA systems (MAs, GSSs and sub-systems/applications).
• Complete and maintain system authorization packages — System Security Plans, Interconnection Security Agreements, Contingency Plans, POA&Ms, waivers and exceptions — in the agency's FISMA system management tool, supporting the NIST Risk Management Framework (RMF).
• Ensure assigned systems are operated, maintained and disposed of in accordance with NIST SP 800-37 Rev. 2 and agency security policy and handbooks.
• Perform periodic security management activities and monthly audit log reviews for assigned systems, identifying and documenting security anomalies.
• Work with system administrators, security engineers and system owners to document and track system weaknesses as POA&Ms; recommend and track corrective actions through remediation.
• Support risk acceptance and waiver requests, system access request reviews, and endorsement or rejection determinations with documented justification.
• Investigate and report security incidents to agency security leadership and ensure protective or corrective measures are initiated when an incident or vulnerability is discovered.
• Review Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs) and provide documented security feedback to system and business owners.
• Lead, prepare materials for and participate in meetings supporting assessment and authorization, vulnerability/POA&M reviews, and internal and external audits.
• Support the transition to and maintenance of an Ongoing Authorization (OA) program for assigned systems.
• Provide audit support and liaison between auditors (e.g., OIG and annual independent audits) and agency cybersecurity staff, including artifact collection and responses across FISMA, FISCAM and OMB Circular A-123 areas.

Requirements:

• Bachelor's degree in Computer Science or a related field, or equivalent experience.
• Minimum 3 years of information security experience on programs of comparable scope and complexity.
• Solid knowledge of FISMA, NIST and the Risk Management Framework (RMF) methodology.
• Experience with security authorization processes (Certification & Accreditation and Authorization to Operate) and the ability to develop the associated documentation.
• Strong understanding of security tools, hardware/software security implementation, communication protocols and encryption techniques.
• Proven ability to analyze security vulnerabilities, deliver comprehensive assessments and develop effective remediation instructions.
• Excellent written and verbal communication skills, with the ability to present complex security information clearly to technical and executive audiences.
• Ability to work on site in Ashburn, VA (no telework).
• US Citizenship (no dual citizenship) and the ability to pass a federal background investigation in order to be granted access to sensitive information.

Preferred: CISSP and/or CISM certification.

Compensation: $120,000 - $144,000 per year