Remote Federal ISSO — RMF, ATO & Compliance Lead

Commence; Virginia; À distance; USD 110 000 - 160 000; Plein temps

Résumé du poste

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization for federal systems supporting CMS, VA, DoD, IRS, and DHS. You will own ATO/ConMon and coordinate with the CIO, ISSM, and engineers to drive continuous monitoring and remediation.

This remote role requires 5+ years in information assurance, RMF knowledge, and Security+ (or higher). U.S. citizenship and eligibility for Public Trust are required.

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems; bachelor’s degree in a related field or equivalent experience.
• Has personally taken at least one federal system through an initial ATO or reauthorization under NIST SP 800-37/800-53, including SSP authorship and POA&M management in various agency specific GRC platforms.
• Working knowledge of at least two of: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publication 1075 & 4812, DHS 4300A. Experience with FedRAMP and HIPAA a plus.
• Comfortable reading vulnerability and configuration scan output (Tenable/Nessus, Defender, AWS Inspector, SCAP/STIG Viewer) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• A clear, precise writer who can run several systems and deadline clocks at once.
• CompTIA Security+ (or higher DoD 8140-qualifying certification) required. CISSP, CGRC (formerly CAP), CISA, or CCSP preferred.
• U.S. citizenship and ability to obtain and maintain federal Public Trust suitability required.

Responsabilités

• ISSO designation and liaison for assigned federal systems; primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams.
• Partner with Project Managers to build security and authorization milestones into project plans and assess security impact of system changes before they ship.
• Run the Security Assessment and Authorization lifecycle under the NIST RMF from categorization through authorization, ongoing authorization, and reauthorization; maintain SSPs and risk artifacts.
• Maintain POA&M in agency GRC platforms; review monthly vulnerability and configuration scans against DISA STIGs, CIS benchmarks, and agency baselines; coordinate remediation.
• Lead system-level preparation for CMS, VA, DoD assessments; work with Compliance Analysts on evidence collection and findings response.
• Maintain compliance with CMS ARS/IS2P2; VA Handbook 6500/6500.6; DFARS 252.204-7012; NIST SP 800-171/CMMC; IRS Pub 1075/4812; DHS 4300A and handling of sensitive info; plus CUI, FISMA, HIPAA, Privacy Act.
• Act as first responder for security and privacy incidents; escalate to ISSM and CIO; meet agency notification clock with Privacy Officer and prime contractors.
• Complete system-level contract security deliverables; manage federal personnel security tasks including Public Trust and e-QIP processing; ensure training and policies.
• Support CIO and ISSM with internal audits and control assessments against SOC 2, NIST CSF 800-53/171, HIPAA, HITRUST, ISO/IEC 27001; provide input to audits by external teams.
• This description is not all-inclusive and may be modified to meet business needs.

Connaissances

ISSO liaison

NIST RMF

FedRAMP knowledge

Vulnerability scanning

AWS/Azure

Strong writing

Security+ or higher

US citizenship

Formation

Bachelor's degree in a related field

Outils

Tenable/Nessus

SCAP/STIG Viewer

GRC platforms

AWS

Description du poste

Commence is seeking an Information System Security Officer (ISSO) to lead security assessments and authorization for federal systems supporting CMS, VA, DoD, IRS, and DHS. You will own ATO/ConMon and coordinate with the CIO, ISSM, and engineers to drive continuous monitoring and remediation.

This remote role requires 5+ years in information assurance, RMF knowledge, and Security+ (or higher). U.S. citizenship and eligibility for Public Trust are required.