Principal Information Systems Security Officer

Jobtome; Washington (District of Columbia); On-site; USD 170,000 - 230,000; Full time

Job summary

Jobtome in Washington, DC is seeking a Principal Information Systems Security Officer (ISSO) to lead cybersecurity strategy across enterprise initiatives, aligning security with Agile delivery, SDLC and DevSecOps while meeting NIST, FISMA and FedRAMP requirements.

You will advise senior leadership, oversee risk assessments, review vulnerabilities and guide secure architecture decisions across cloud, containerized and hybrid environments, partnering with engineering and business teams to embed

Qualifications

• Minimum 10+ years of cybersecurity experience with 5+ years in ISSO/Information Assurance or security architecture.
• In-depth knowledge of NIST RMF, NIST SP 800-53 and FISMA with FedRAMP experience.
• Experience delivering security in Agile, SAFe, SDLC and DevSecOps.
• Ability to develop SSPs, RARs, SAPs and POA&Ms and engage with federal compliance.

Responsibilities

• Advise leadership on cybersecurity risks, compliance gaps and mitigations.
• Review vulnerabilities and support risk-based decisions.
• Evaluate secure architectures for cloud, container, and hybrid setups.
• Support DevSecOps, continuous monitoring and secure config.
• Ensure compliance with NIST SP 800-37, 800-53, FISMA and FedRAMP.
• Develop security docs: SSPs, RARs, SAPs, POA&Ms.
• Partner with engineering and business teams to mitigate risks.
• Embed secure-by-design practices in SDLC, Agile, SAFe.
• Lead risk assessments, threat modeling and security reviews.

Skills

Stakeholder management

Cybersecurity advisory

Security risk assessments

Vulnerability management

Threat modeling

Cloud security (AWS/Azure/GCP)

Agile/SAFe/DevSecOps

SSP/RAR/SAP/POA&Ms

FedRAMP

NIST RMF/NIST SP 800-53/FISMA

ISSO/Information Assurance

10+ years cybersecurity

5+ years in ISSO/security architecture

Job description

Job Overview

We are seeking an experienced Principal Information Systems Security Officer (ISSO) to provide cybersecurity leadership, risk management and security architecture guidance across enterprise technology initiatives. The role focuses on integrating security into Agile delivery, SDLC and DevSecOps practices while ensuring compliance with federal security frameworks, including NIST, FISMA and FedRAMP.

Key Responsibilities

• Advise senior leadership on cybersecurity risks, compliance gaps and mitigation strategies.
• Review vulnerabilities, recommend remediation strategies and support risk-based security decisions.
• Evaluate cloud, containerized and hybrid infrastructure architectures for security risks.
• Support DevSecOps implementation, continuous monitoring and secure configuration practices.
• Ensure compliance with NIST SP 800-37, NIST SP 800-53, FISMA and FedRAMP requirements.
• Develop and review security documentation, including SSPs, RARs, SAPs and POA&Ms.
• Partner with engineering, architecture and business teams to identify and mitigate cybersecurity risks.
• Embed security controls and secure-by-design principles into SDLC, Agile and SAFe delivery processes.
• Lead cybersecurity risk assessments, threat modeling and security architecture reviews across enterprise programs.

Mandatory Skills

• Strong stakeholder management and cybersecurity advisory skills.
• Experience in security risk assessments, vulnerability management and threat modeling.
• Knowledge of cloud security across AWS, Azure or GCP.
• Strong understanding of Agile, SAFe, SDLC and DevSecOps.
• Experience with System Security Plans (SSP), Risk Assessment Reports (RAR), Security Assessment Plans (SAP) and POA&Ms.
• Hands-on experience with FedRAMP and federal cybersecurity compliance.
• Strong experience with NIST RMF, NIST SP 800-53 and FISMA.
• 10+ years of cybersecurity experience, including 5+ years in ISSO, Information Assurance or Security Architecture roles.

Preferred Skills

• Background in federal government or government-regulated environments.
• Experience with CI/CD security integration and continuous monitoring.
• Knowledge of container security, API security and hybrid cloud environments.
• Experience with NIST SP 800-160, ISO 27001 and CIS Benchmarks.

Certifications

(At least one relevant industry-recognized certification is required.)

• CISA
• CCSP
• CRISC
• CISM
• CISSP