Remote Federal Information System Security Officer

Commence; Beryl (WV); Remote; USD 110,000 - 160,000; Full time

Job summary

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization activities for federal programs. You will own RMF processes, ATO packages, continuous monitoring, and maintain strong collaboration with the CIO, ISSM, and project teams.

The role requires experience with CMS, VA, DoD/DHA, IRS, and DHS security controls, along with precise writing and risk-management skills to ensure secure, compliant operations in a remote setup.

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems; bachelor’s degree in a related field or equivalent experience.
• Has personally taken at least one federal system through an initial ATO or reauthorization under NIST SP, including SSP authorship and POA&M management in various agency GRC platforms.
• Working knowledge of at least two of: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC; IRS Publication 1075 & 4812; DHS 4300A. FedRAMP and HIPAA a plus.
• Comfortable reading vulnerability and configuration scan output (Tenable/Nessus, Defender, AWS Inspector, SCAP/STIG Viewer) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• A clear, precise writer who can run several systems and deadline clocks at once.
• CompTIA Security+ (or higher DoD 8140-qualifying certification) required. CISSP, CGRC (formerly CAP), CISA, or CCSP preferred.
• U.S. citizenship and ability to obtain and maintain federal Public Trust suitability required.

Responsibilities

• ISSO designation and liaison. Serve as the designated ISSO for assigned federal systems and the primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams; carry out priorities set by the CIO and ISSM; escalate program-level issues, risk acceptances, and exceptions to the ISSM with a recommended path.
• Project and cross-functional coordination. Partner with Project Managers to build security and authorization milestones into project plans, assess the security impact of system changes before they ship, and keep federal deliverable dates visible to project and program teams.
• ATO packages. Run the Security Assessment and Authorization lifecycle under the NIST Risk Management Framework (SP 800-37) from FIPS 199 categorization through authorization, ongoing authorization, and reauthorization. Author and maintain the System Security and Privacy Plan, risk assessment, Privacy Impact Assessment, contingency plan and annual test, incident response plan, configuration management plan, and interconnection agreements, for ISSM review.
• Continuous monitoring and POA&M. Maintain POA&M in agency GRC platforms; review monthly vulnerability and configuration scans against DISA STIGs, CIS benchmarks, and agency baselines; assign and track remediation with Cybersecurity Engineers and IT Operations to agency timelines; prepare ongoing-authorization and ConMon reports.
• Agency assessments. Lead system-level preparation for CMS Security Controls Assessments and Adaptive Capabilities Testing, VA and DoD assessments, and IRS Safeguards reviews; work with Compliance Analysts on evidence collection and findings response.
• Agency-specific requirements. Maintain compliance with current and future agency requirements to include CMS ARS and IS2P2; VA Handbook 6500 and 6500.6; DFARS , NIST SP 800-171, and CMMC 2.0 for DoD/DHA; IRS Publication 1075 & 4812; DHS 4300A and Sensitive Security Information handling; plus CUI, FISMA, HIPAA, and the Privacy Act.
• Incident reporting. Act as first responder for security and privacy incidents affecting federal data on assigned systems; escalate immediately to the ISSM and CIO; meet agency notification clock in coordination with the Privacy Officer and prime contractors.
• Contract deliverables and personnel security. Complete system-level contract security deliverables; manage federal personnel security tasks (Public Trust and e-QIP processing, agency training, rules of behavior, access attestations).
• Internal audit and framework support. Support the CIO and ISSM with internal audits and control assessments against SOC 2, NIST CSF/SP 800-53/800-171, HIPAA, HITRUST, ISO/IEC 27001; provide system-specific input to the ISSM and Compliance Analyst.
• This description is not all-inclusive and may be modified to meet the needs of the business.

Skills

Information security

Cybersecurity

Federal systems knowledge

Writing & documentation

U.S. citizenship

Education

Bachelor's degree in a related field

CompTIA Security+ or higher (DoD 8140)

CISSP / CISA / CCSP / CGRC (preferred)

Tools

Tenable Nessus

AWS Inspector

SCAP/STIG Viewer

AWS/Azure familiarity

Job description

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization activities for federal programs. You will own RMF processes, ATO packages, continuous monitoring, and maintain strong collaboration with the CIO, ISSM, and project teams.

The role requires experience with CMS, VA, DoD/DHA, IRS, and DHS security controls, along with precise writing and risk-management skills to ensure secure, compliant operations in a remote setup.