Principal Information Systems Security Officer (ISSO)

Veriipro; Washington; On-site; USD 150,000 - 210,000; Full time

Job summary

Veriipro is seeking an experienced Principal Information Systems Security Officer to lead cybersecurity strategy across enterprise initiatives, integrating security into Agile delivery, SDLC and DevSecOps while aligning with NIST, FISMA and FedRAMP.

This role partners with engineering and business teams to assess risks, design secure architectures, and ensure compliant operations across cloud and on-prem environments.

Qualifications

• Strong advisory and stakeholder management skills.
• Experience in security risk assessments, vulnerability management and threat modeling.
• Deep knowledge of cloud security across AWS, Azure or GCP.
• Solid understanding of Agile, SAFe, SDLC and DevSecOps.
• Hands-on with SSP, RAR, SAP and POA&Ms and federal compliance.

Responsibilities

• Advise senior leadership on cybersecurity risks, compliance gaps and mitigation strategies.
• Review vulnerabilities, remediation strategies and risk-based security decisions.
• Evaluate cloud, containerized and hybrid infrastructure for security risks.
• Support DevSecOps, continuous monitoring and secure configuration practices.
• Ensure compliance with NIST SP 800-37, NIST SP 800-53, FISMA and FedRAMP.
• Develop and review SSPs, RARs, SAPs and POA&Ms.
• Partner with engineering, architecture and business teams to mitigate cybersecurity risks.
• Embed security controls into SDLC, Agile and SAFe delivery processes.
• Lead cybersecurity risk assessments, threat modeling and security architecture reviews.

Skills

Cybersecurity advisory

Security risk assessments

Threat modeling

Cloud security (AWS/Azure/GCP)

FedRAMP/NIST RMF

NIST SP 800-53

SAFe/Agile/DevSecOps

SSP/RAR/SAP/POA&M

Vulnerability management

Stakeholder communication

Job description

Job Overview

We are seeking an experienced Principal Information Systems Security Officer (ISSO) to provide cybersecurity leadership, risk management and security architecture guidance across enterprise technology initiatives. The role focuses on integrating security into Agile delivery, SDLC and DevSecOps practices while ensuring compliance with federal security frameworks, including NIST, FISMA and FedRAMP.

Key Responsibilities

• Advise senior leadership on cybersecurity risks, compliance gaps and mitigation strategies.
• Review vulnerabilities, recommend remediation strategies and support risk-based security decisions.
• Evaluate cloud, containerized and hybrid infrastructure architectures for security risks.
• Support DevSecOps implementation, continuous monitoring and secure configuration practices.
• Ensure compliance with NIST SP 800-37, NIST SP 800-53, FISMA and FedRAMP requirements.
• Develop and review security documentation, including SSPs, RARs, SAPs and POA&Ms.
• Partner with engineering, architecture and business teams to identify and mitigate cybersecurity risks.
• Embed security controls and secure-by-design principles into SDLC, Agile and SAFe delivery processes.
• Lead cybersecurity risk assessments, threat modeling and security architecture reviews across enterprise programs.

Mandatory Skills

• Strong stakeholder management and cybersecurity advisory skills.
• Experience in security risk assessments, vulnerability management and threat modeling.
• Knowledge of cloud security across AWS, Azure or GCP.
• Strong understanding of Agile, SAFe, SDLC and DevSecOps.
• Experience with System Security Plans (SSP), Risk Assessment Reports (RAR), Security Assessment Plans (SAP) and POA&Ms.
• Hands-on experience with FedRAMP and federal cybersecurity compliance.
• Strong experience with NIST RMF, NIST SP 800-53 and FISMA.
• 10+ years of cybersecurity experience, including 5+ years in ISSO, Information Assurance or Security Architecture roles.

Preferred Skills

• Background in federal government or government-regulated environments.
• Experience with CI/CD security integration and continuous monitoring.
• Knowledge of container security, API security and hybrid cloud environments.
• Experience with NIST SP 800-160, ISO 27001 and CIS Benchmarks.

Certifications (At least one relevant industry-recognized certification is required.)

• CISA
• CCSP
• CRISC
• CISM
• CISSP