Remote Federal Information Security Officer (ISSO)

Commence; Phoenix (AZ); Remote; USD 110,000 - 165,000; Full time

Job summary

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization for federal systems supporting CMS, VA, DoD/DHA, IRS, and DHS/TSA. You will own the RMF lifecycle, develop SSPs, risk assessments, and POAMs, and coordinate with multiple agencies and internal teams.

The role requires CISSP or equivalent, 5+ years in information assurance, and 3+ years as ISSO/A&A lead. Remote work with 15-25% travel is available; U.S. citizenship is required.

Qualifications

• 5+ years in information assurance or cybersecurity.
• 3+ years as ISSO or A&A lead for federal information systems.
• Bachelor's degree in a related field or equivalent experience.
• Experience with NIST RMF, SP 800-53/171, and authorization processes.
• Familiarity with CMS ARS/IS2P2, VA 6500, DoD RMF, IRS 1075 & 4812; HIPAA/CUI knowledge.

Responsibilities

• Serve as the designated ISSO for assigned federal systems and liaison to agency ISSOs and officials.
• Lead Security Assessment and Authorization lifecycle per NIST RMF (SP 800-37) from categorization through authorization.
• Prepare and maintain SSP, risk assessments, PIA, contingency and incident response plans, and test plans.
• Maintain POA&M in agency GRC platforms; track remediation with Cybersecurity Engineers and IT Ops.
• Lead CMS VA/DoD/IRS assessments and evidence collection; coordinate findings responses.
• Ensure ongoing compliance with CMS ARS/IS2P2, VA 6500, DFARS, NIST SP 800-171/CMMC 2.0, IRS publications, DHS 4300A, and HIPAA.

Skills

ISSO experience

NIST RMF knowledge

Security compliance

Cloud security (AWS/Azure)

Strong written communication

US citizenship

Education

Bachelor's degree or equivalent experience

Tools

Tenable Nessus

AWS Inspector

SCAP/STIG Viewer

FedRAMP familiarity

Job description

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization for federal systems supporting CMS, VA, DoD/DHA, IRS, and DHS/TSA. You will own the RMF lifecycle, develop SSPs, risk assessments, and POAMs, and coordinate with multiple agencies and internal teams.

The role requires CISSP or equivalent, 5+ years in information assurance, and 3+ years as ISSO/A&A lead. Remote work with 15-25% travel is available; U.S. citizenship is required.