Principal Information System Security Officer (ISSO)

Randstad USA; Washington (District of Columbia); On-site; USD 69,000 - 83,000; Full time

Job summary

Randstad Digital in Washington, DC seeks a Principal Information System Security Officer (ISSO) to embed cybersecurity as a strategic risk advisor across Agile Release Trains and product delivery. You will champion secure-by-design practices and drive secure technical decision-making with business stakeholders and engineering teams.

The role focuses on risk governance, compliance with NIST/FISMA/FedRAMP, and DevSecOps integration across enterprise architectures.

Qualifications

• 10+ years of progressive cybersecurity experience including ISSO/IA or security architecture in enterprise or government-adjacent environments.
• Deep knowledge of NIST SP 800-series (RMF, 800-53), FISMA, FedRAMP, ISO 27001 and CIS Benchmarks.
• Experience embedding security governance in Agile/SAFe and modern CI/CD pipelines.

Responsibilities

• Provide cybersecurity design oversight, threat modeling, and risk governance across ARTs and product pipelines.
• Embed security architectures and baseline controls early in SDLC to reduce debt and deployment risks.
• Serve as liaison between product managers, architects, engineers, and executives to balance agility with risk.
• Create and evaluate SSPs, RARs, SAPs, and POA&Ms.
• Ensure compliance with NIST, FISMA, FedRAMP and internal governance directives.
• Operationalize DevSecOps and automate continuous monitoring with secure coding standards.
• Lead remediation strategies for complex vulnerability findings.

Skills

Agile

AWS

APIs

CIS Benchmarks

Cybersecurity

Security Architecture

DevSecOps

CI/CD

NIST RMF

FedRAMP

Cloud architecture

Threat modeling

Security governance

SSPs

Security controls

Vulnerability management

Education

Bachelor's degree

Tools

Cloud platforms (AWS/Azure/GCP)

CI/CD pipelines

SAFe

Job description

job summary: Randstad is seeking a highly skilled Principal Information System Security Officer (ISSO) to serve as an embedded cybersecurity subject matter expert and strategic risk advisor for our premier client in Washington, DC. In this role, you will champion \"secure-by-design\" principles across enterprise Agile Release Trains (ARTs) and strategic cyber risk operations, ensuring security controls and regulatory compliance are integrated early into system architecture and solution delivery. As a critical bridge between business stakeholders, software engineering, enterprise architecture, and cybersecurity teams, you will drive secure technical decision-making, mitigate deployment risks, reduce technical debt, and ensure continuous alignment with federal and industry compliance standards.

Location: Washington, Washington, D.C.

Job type: Contract

Salary: $50 - 60 per hour

Work hours: 9am to 5pm

Education: Bachelors

Responsibilities

• Provide dedicated cybersecurity design oversight, threat modeling, and risk governance across Agile Release Trains (ARTs) and product delivery pipelines.
• Embed security architectures and baseline controls early into system development lifecycles (SDLC) to reduce technical debt, deployment risks, and post-production remediation costs.
• Serve as the primary cybersecurity liaison connecting product managers, enterprise architects, engineering squads, and senior executive stakeholders to balance agility with risk tolerance.
• Guide, author, and evaluate security artifacts-including System Security Plans (SSPs), Risk Assessment Reports (RARs), Security Assessment Plans (SAPs), and Plans of Action & Milestones (POA&Ms).
• Ensure enterprise and system compliance with applicable frameworks and mandates, such as NIST SP 800-37, 800-53, FISMA, FedRAMP, and internal cyber governance directives.
• Partner with engineering leads to operationalize DevSecOps practices, automate continuous monitoring, and incorporate secure coding and configuration standards.
• Facilitate risk-based trade-off decisions, review proposed architecture deviations, and lead remediation strategies for complex vulnerability findings.

Qualifications

• Experience: 10+ years of progressive cybersecurity experience with at least 5+ years in an ISSO, Information Assurance (IA), or Security Architecture capacity within enterprise or government-adjacent environments.
• Agile & DevSecOps Expertise: Demonstrated experience embedding security governance within Agile/Scrum/SAFe methodologies and modern CI/CD pipelines.
• Regulatory & Framework Mastery: Deep operational knowledge of NIST SP 800-series (800-37 RMF, 800-53, 800-160), FISMA, FedRAMP, and industry security frameworks (e.g., ISO 27001, CIS Benchmarks).
• Technical Breadth: Strong background evaluating cloud architectures (AWS, Azure, or GCP), containerized platforms, APIs, and modern hybrid enterprise infrastructures for risk exposure.
• Communication & Influence: Proven ability to translate complex security requirements into actionable technical guidance for developers while conveying business risk effectively to non-technical leadership.
• Certifications: Active industry-recognised certification required (e.g., CISSP, CISM, CRISC, CCSP, or CISA).
• Location & Clearance: Based in the greater Washington, DC metropolitan area; ability to obtain or maintain a client-specific public trust or security clearance as required.

Skills

Agile,AWS,APIs,CIS Benchmarks,cybersecurity,Security Architecture,DevSecOps practices,DevSecOps,Information System Security,Azure,Agile/Scrum,secure coding,software engineering,system architecture,system development,SDLC,technical debt,agility,Communication,technical decision-making,architecture,automate,CISM,CISSP,CRISC,CCSP,continuous monitoring,ARTs,enterprise architecture,FISMA,FedRAMP,governance,ISO 27001,cyber risk,security frameworks,Information Assurance,security governance,infrastructures,compliance standards,system compliance,remediation strategies,NIST,operationalize,post-production,regulatory compliance,risks,Risk Assessment Reports,risk exposure,risk tolerance,risk governance,business risk,security clearance,Security Assessment,security controls,security requirements,SSPs,solution delivery,System Security,technical leadership,threat modeling,vulnerability

Equal Opportunity Employer

Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.

Accommodations

At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact [e-mail].

Pay and Benefits

Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).

Posting Duration

This posting is open for thirty (30) days.

Additional Qualifications

Experience: 10+ years of progressive cybersecurity experience with at least 5+ years in an ISSO, Information Assurance (IA), or Security Architecture capacity within enterprise or government-adjacent environments.Agile & DevSecOps Expertise: Demonstrated experience embedding security governance within Agile/Scrum/SAFe methodologies and modern CI/CD pipelines.Regulatory & Framework Mastery: Deep operational knowledge of NIST SP 800-series (800-37 RMF, 800-53, 800-160), FISMA, FedRAMP, and industry security frameworks (e.g., ISO 27001, CIS Benchmarks).Technical Breadth: Strong background evaluating cloud architectures (AWS, Azure, or GCP), containerized platforms, APIs, and modern hybrid enterprise infrastructures for risk exposure.Communication & Influence: Proven ability to translate complex security requirements into actionable technical guidance for developers while conveying business risk effectively to non-technical leadership.Certifications: Active industry-recognised certification required (e.g., CISSP, CISM, CRISC, CCSP, or CISA).Location & Clearance: Based in the greater Washington, DC metropolitan area; ability to obtain or maintain a client-specific public trust or security clearance as required.