Remote ISSO - Federal Info Security Lead

Commence; Pennsylvania; Remote; USD 100,000 - 150,000; Full time

Job summary

Commence is seeking an Information System Security Officer (ISSO) to lead security assessment, authorization, and continuous monitoring for federal programs. You will own the system security lifecycle, coordinating with CIO, engineers, and compliance teams to maintain authorizations and sampling for CMS, VA, DoD, IRS, and DHS/TSA.

You will manage ATO packages, risk assessments, and incident response planning while ensuring compliance with NIST SP 800-37, 800-53, 800-171, and CMMC 2.0.

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems.
• Bachelor’s degree in a related field or equivalent experience.
• Familiarity with CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC; IRS Pub 1075 & 4812; HIPAA and related regulating frameworks.

Responsibilities

• Serve as designated ISSO for federal systems and primary system-level security liaison to agency ISSOs and Authorizing Officials.
• Coordinate with CIO, Cybersecurity Engineers, Compliance Analysts, Project Managers and other departments on security milestones.
• Prepare and maintain ATO packages, SSP, risk assessments, PIA, contingency plan and testing.
• Maintain POA&M in agency GRC platforms; track remediation with Cybersecurity Engineers and IT Operations.
• Lead CMS/VA/DoD/IRS assessments and ensure evidence collection and findings response.
• Ensure compliance with CMS ARS/IS2P2, VA 6500, DFARS, NIST SP 800-171/CMMC, IRS 1075/4812, DHS 4300A, CUI, HIPAA and Privacy Act.

Skills

Information Assurance

Cybersecurity

ISSO/A&A lead

Federal systems

NIST RMF

Compliance

Vulnerability scanning

Cloud/AWS

Written communication

US citizenship

Education

Bachelor's degree

Tools

Tenable/Nessus

SCAP/STIG Viewer

AWS

Microsoft 365/Azure

Job description

Commence is seeking an Information System Security Officer (ISSO) to lead security assessment, authorization, and continuous monitoring for federal programs. You will own the system security lifecycle, coordinating with CIO, engineers, and compliance teams to maintain authorizations and sampling for CMS, VA, DoD, IRS, and DHS/TSA.

You will manage ATO packages, risk assessments, and incident response planning while ensuring compliance with NIST SP 800-37, 800-53, 800-171, and CMMC 2.0.