Remote ISSO for Federal Systems Security Lead

COMMENCE; Virginia Beach (VA); Remote; USD 110,000 - 150,000; Full time

Job summary

Commence seeks an Information System Security Officer (ISSO) to lead security assessment, authorization, and continuous monitoring for federal programs. You will collaborate with the CIO, cybersecurity engineers, compliance analysts, and project teams to ensure authorization to operate across CMS, VA, DoD, IRS, and DHS/TSA systems.

The role requires 5+ years in information assurance, 3+ years as an ISSO/A&A lead, and proficiency with RMF, NIST controls, and cloud platforms (AWS/Azure).

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems; bachelor’s degree in a related field or equivalent experience.
• Has personally taken at least one federal system through an initial ATO or reauthorization under NIST SP 800-37/800-53, including SSP authorship and POA&M management in various agency specific GRC platforms.
• Working knowledge of at least two of: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publication 1075 & 4812, DHS 4300A. Experience with FedRAMP and HIPAA a plus.
• Comfortable reading vulnerability and configuration scan output (Tenable/Nessus, Defender, AWS Inspector, SCAP/STIG Viewer) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• A clear, precise writer who can run several systems and deadline clocks at once.
• CompTIA Security+ (or higher DoD 8140-qualifying certification) required. CISSP, CGRC (formerly CAP), CISA, or CCSP preferred.
• U.S. citizenship and ability to obtain and maintain federal Public Trust suitability required.

Responsibilities

• ISSO designation and liaison with agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams; elevate program-level issues and exceptions to the ISSM.
• Partner with Project Managers to build security and authorization milestones into project plans, assess security impact of changes, and keep federal deliverables on track.
• Run the Security Assessment and Authorization lifecycle under NIST RMF from categorization to authorization and continuous monitoring.
• Maintain SSPs, risk assessments, Privacy Impact Assessments, contingency and incident response plans, and interconnection agreements for ISSM review.
• Lead system-level preparation for CMS, VA, DoD, IRS assessments; work with Compliance Analysts on evidence collection.
• Maintain compliance with CMS ARS/IS2P2; VA Handbook 6500; DFARS 252.204-7012; NIST SP 800-171/CMMC; IRS 1075/4812; DHS 4300A and more.
• Act as first responder for security and privacy incidents; complete contract security deliverables and personnel security tasks.
• Support internal audits and CSF/PCI/HIPAA/HITRUST/ISO controls; provide input for audits and questionnaires.

Skills

Information assurance

ISSO experience

NIST RMF

FedRAMP knowledge

HIPAA knowledge

Security+

AWS

Azure

US citizenship

Education

Bachelor’s degree

Tools

Tenable/Nessus

SCAP/STIG Viewer

AWS Inspector

Defender

Job description

Commence seeks an Information System Security Officer (ISSO) to lead security assessment, authorization, and continuous monitoring for federal programs. You will collaborate with the CIO, cybersecurity engineers, compliance analysts, and project teams to ensure authorization to operate across CMS, VA, DoD, IRS, and DHS/TSA systems.

The role requires 5+ years in information assurance, 3+ years as an ISSO/A&A lead, and proficiency with RMF, NIST controls, and cloud platforms (AWS/Azure).