Lead Information System Security Officer (ISSO)

C3EL; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Job summary

C3EL seeks a Lead Information System Security Officer (ISSO) to provide on-site cybersecurity and RMF sustainment support in Washington, D.C. The role acts as the single point of accountability for technical performance and remains a hands-on practitioner, leading the ISSO program and coordinating with government stakeholders.

The ideal candidate has extensive RMF/ISSO experience, with strong leadership skills to manage a two-person team and deliver audit-ready documentation under strict

Qualifications

• Eligibility to obtain Tier 4 High‑Risk Public Trust.
• Minimum 10 years in cybersecurity.
• Minimum 7 years in federal RMF/ISSO work.
• Minimum 3 years leading ISSO or authorization teams.
• Hands-on CSAM experience with system profiles, controls, evidence, POA&M, and authorization workflows.
• Working knowledge of NIST SP 800-37, 800-53, 800-53B, FIPS 199, FISMA, and applicable guidance.
• Familiarity with GRC, ITSM, SIEM, scanner, identity, endpoint, and cloud-security platforms.
• Direct experience briefing and coordinating with ISSMs, CISOs, AOs, AODRs, System Owners, assessors, and senior Government officials.
• Direct experience overseeing SSPs, SAPs, SARs, POA&Ms, risk assessments, control statements, and evidence packages.
• Expert knowledge of all seven RMF steps, ATO, reauthorization, ongoing authorization, control baselines, and inheritance.

Responsibilities

• Provide on-site cybersecurity and RMF sustainment support.
• Chair internal quality reviews and ensure deliverables are audit ready.
• Manage technical risks, issues, escalations, SLA/KPI/AQL performance, action items, and corrective actions.
• Support weekly/monthly/quarterly reports, including authorization, vulnerability, POA&M, audit, and staffing status.
• Lead a team of two Senior ISSOs and cover during absences or surges.
• Produce accurate, concise, audit-ready Government cybersecurity documentation.
• Support team coverage from 7:00 a.m. to 6:00 p.m. ET and after-hours incident coverage as needed.

Skills

RMF leadership

NIST SP 800-37/800-53 knowledge

GRC

SIEM

ServiceNow

Education

Associate's degree in Cybersecurity

Tools

ServiceNow

Splunk

Vulnerability scanners

Job description

Lead Information System Security Officer (ISSO)

Washington, D.C.

CONTINGENT UPON CONTRACT AWARD

Overview:

Job Title: Lead Information System Security Officer (ISSO)

Security Clearance: Ability to Obtain Tier 4 High-Risk Public Trust

Location: Washington, D.C.

(Due to the nature of the work and contract requirements, U.S. Citizenship isrequired.)

Description:

C3EL is seeking a Lead Information System Security Officer (ISSO) to provide on-site cybersecurity and Risk Management Framework (RMF) sustainment support in Washington, D.C., for a new contract. This role will serve as the single point of accountability for technical performance and remain a hands‑on cybersecurity practitioner as the technical leader, Government interface, and quality authority for the entire ISSO program.

Responsibilities will include, but not be limited to:

• Provide on-site cybersecurity and RMF sustainment support.
• Chair internal quality reviews and ensure deliverables are complete, current, consistent, timely, and audit ready.
• Manage technical risks, issues, escalations, SLA/KPI/AQL performance, action items, and corrective actions.
• Support weekly reports, monthly status reports, and quarterly executive reviews, including authorization, vulnerability, POA&M, audit, and staffing status.
• Lead a team of two Senior ISSOs and maintain coverage during absence, vacancy, surge, or suitability delay.
• Produce accurate, concise, and audit‑ready Government cybersecurity documentation.
• Support team coverage from 7:00 a.m. to 6:00 p.m. ET (M-F) and participate in after‑hours incident coverage as needed.

Minimum Qualifications:

• Eligibility to obtain a Tier 4 High‑Risk Public Trust.
• Minimum ten (10) years in cybersecurity.
• Minimum seven (7) years in federal RMF/ISSO work.
• Minimum three (3) years leading ISSO or authorization teams.
• Hands‑on CSAM experience supporting system profiles, controls, evidence, POA&Ms, and authorization workflows.
• Working knowledge of NIST SP 800-37, 800-53, 800-53B, FIPS 199, FISMA, and applicable CISA/OMB guidance.
• Familiarity with GRC, ITSM, SIEM, scanner, identity, endpoint, and cloud‑security platforms.
• Direct experience briefing and coordinating with ISSMs, CISOs, AOs, AODRs, System Owners, assessors, and senior Government officials.
• Direct experience overseeing SSPs, SAPs, SARs, POA&Ms, risk assessments, control statements, and evidence packages.
• Expert knowledge of all seven RMF steps, ATO, reauthorization, ongoing authorization, control baselines, and inheritance.
• Working proficiency with ServiceNow, Splunk, and vulnerability‑scanning platforms.

Preferred Qualifications:

• At least one current cybersecurity certification such as CISSP, CGRC, CISM, CRISC, Security+, SecurityX, CCSP, or GIAC.

Education:

• Associate's degree in Cybersecurity, Information Technology, or related field. (Relevant experience may be considered in lieu of formal education.)

Voluntary Self-Identification

As set forth in C3EL's Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service‑connected disability.

A "recently separated veteran" means any veteran during the three‑year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.