Remote Federal Systems ISSO and Security Compliance Lead

Commence; Bozeman (MT); Remote; USD 120,000 - 170,000; Full time

Job summary

Commence is seeking an Information System Security Officer (ISSO) to own security assessment, authorization, and continuous monitoring for federal systems. You will partner with CIO, engineers, and compliance teams to maintain SSPs, risk assessments, and agency evidence across CMS, VA, DoD, IRS, and DHS programs.

You will coordinate RMF activities, prepare for CMS/VA/DoD assessments, and respond to security incidents while supporting internal audits and vendor questionnaires.

Qualifications

• Bachelor’s degree in a related field or equivalent experience.
• 5+ years of information assurance or cybersecurity experience.
• 3+ years as an ISSO or A&A lead for federal information systems.
• Familiarity with CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Pub 1075 & 4812, DHS 4300A.
• Comfort reading vulnerability and configuration scan output (Tenable/Nessus, Defender, AWS Inspector, SCAP/STIG Viewer) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.

Responsibilities

• Serve as ISSO for assigned federal systems and lead security assessment activities.
• Manage RMF lifecycle, SSP, risk assessments, and POA&M with collaboration across teams.
• Coordinate with agency ISSOs, Authorizing Officials, and prime contractor security teams.
• Prepare CMS ARS/IS2P2, VA/DoD, and IRS assessments; ensure timely evidence collection and response.
• Lead audits and control assessments against SOC 2, NIST CSF, 800-53, 800-171, HIPAA, HITRUST, and ISO 27001.
• Support project managers in embedding security milestones into project plans.

Skills

Information security

Risk Management Framework

NIST SP 800-37

Cloud security

Vulnerability management

Education

Bachelor's degree in a related field

Tools

Nessus/Tenable

SCAP/STIG Viewer

AWS Inspector

Defender

AWS/Azure

Job description

Commence is seeking an Information System Security Officer (ISSO) to own security assessment, authorization, and continuous monitoring for federal systems. You will partner with CIO, engineers, and compliance teams to maintain SSPs, risk assessments, and agency evidence across CMS, VA, DoD, IRS, and DHS programs.

You will coordinate RMF activities, prepare for CMS/VA/DoD assessments, and respond to security incidents while supporting internal audits and vendor questionnaires.