RMF/ATO ISSO - Security Assessment Expert

CGS Federal (Contact Government Services); Boston (MA); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health, Dental, and Vision

Life Insurance

401k

Flexible Spending Account

Paid Time Off

Job summary

CGS seeks an Information Systems Security Officer (ISSO) with DIACAP and RMF experience to support Department of Commerce systems and achieve Authorization to Operate (ATO). This on-site role in Washington, DC, covers full life-cycle assessment and authorization management across RMF steps, delivering security oversight in line with NIST 800.53 and DoC policy.

You will draft, review, and finalize cyber security assessments, risk documentation, and test reports, while coordinating with ISSM, SCA,

Qualifications

• Bachelor’s degree required.
• 5+ years as IA/ISSO or similar in ATO package development.
• Experience with security documentation and STIG/IAVA compliance.
• Experience with eMASS and RMF processes.
• Professional security certifications (e.g., CCNA Security, CySA+, GSEC, Security+ CE).
• Strong Word/Excel and technical writing skills.

Responsibilities

• Review systems to identify security weaknesses and recommend improvements.
• Maintain responsibility for cybersecurity risk from an organizational perspective.
• Identify risks, prioritize, and maintain a risk registry for leadership review.
• Provide security guidance and IS validation under NIST RMF, DoC, and local policies.
• Coordinate CM with ISSM, SCA, and AO; ensure patch management and vulnerability remediation.
• Support DIACAP to RMF transition and security accreditation activities.
• Develop risk assessment reports including thresholds, evaluations, and scoring.
• Offer expert guidance for mitigation strategies on risk findings.

Skills

Security assessment

RMF guidance

Risk management

Configuration management

Written communication

Security policy knowledge

Education

Bachelor’s Degree

Tools

eMASS

HBSS

ACAS

Job description

CGS seeks an Information Systems Security Officer (ISSO) with DIACAP and RMF experience to support Department of Commerce systems and achieve Authorization to Operate (ATO). This on-site role in Washington, DC, covers full life-cycle assessment and authorization management across RMF steps, delivering security oversight in line with NIST 800.53 and DoC policy.

You will draft, review, and finalize cyber security assessments, risk documentation, and test reports, while coordinating with ISSM, SCA,