Senior Information Systems Security Officer

Ddc Dine; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Ddc Dine is seeking a Senior Information Systems Security Officer to lead our ISSO and Risk and Compliance teams, guiding risk management, compliance, and security programs across government and commercial sectors.

The role requires deep expertise in RMF, FedRAMP, NIST standards, and HIPAA considerations, with hands-on oversight of SSPs, SARs, POA&Ms, and ATO processes.

Qualifications

• Bachelor's degree required; 10+ years of relevant experience.
• Public Trust clearance or equivalent preferred.
• CISSP certification and strong RMF/FedRAMP knowledge.

Responsibilities

• Lead ISSO and Risk & Compliance teams across gov and commercial sectors.
• Oversee risk management, compliance activities, and accreditation efforts.
• Perform security control assessments per NIST RMF and FedRAMP.
• Develop RMF packages; review SSPs, SARs, POA&Ms, and ATOs.
• Coordinate with 3PAOs for FedRAMP readiness and audits.
• Train and mentor security staff; advise leadership on risk posture.
• Ensure HIPAA, NIST, and FISMA alignment across systems.

Skills

FedRAMP

RMF

NIST RMF

Risk management

Governance

Vulnerability management

Communication

Project management

Education

Bachelor's Degree in a relevant field

Master’s Degree preferred

Tools

Nessus

Archer GRC

Tenable

Job description

## Senior Information Systems Security OfficerApply: Remote: Full time: Posted Yesterday: JR100426We are seeking a **Senior Information Systems Security Officer** to join our dynamic team. In this role, you will lead our client's ISSO and Risk and Compliance teams, overseeing activities related to risk management, compliance, and information system security. Your expertise in FedRAMP, RMF, and accreditation assessments will be crucial in ensuring our client's systems adhere to Federal standards. **Responsibilities:*** **Accreditation Assessments:** + Perform security control assessment services for clients in commercial and government sectors, ensuring compliance with NIST RMF and FedRAMP requirements. + Develop and review RMF packages with meticulous attention to detail and accuracy. + Assist contract companies in meeting Federal agency including OMB, and EO or Intelligence Community mandates for security compliance. + Collaborate with private entities to establish effective cybersecurity programs, particularly for critical infrastructure. + Maintain FISMA authorization to operate for information systems through internal audits and adherence to NIST RMF security controls. + Act as the primary advisor on NIST RMF compliance, offering guidance on resolving outstanding issues and meeting security control requirements. + Conduct comprehensive security control assessments following NIST, IHS, and CISA guidelines. + Provide expert recommendations to the Approval Official regarding network and system authorizations + Assist with implementing General Support Systems (GSS) + Assist with implementing Common Controls + Assist advising continuous monitoring and implementing RBD program + Train and educate team members and stakeholders on NIST RMF principles and best practices. * **FedRAMP Compliance:** + Serve as the organization's trusted Subject Matter Expert (SME) for FedRAMP, wielding a deep understanding of its requirements, guidelines, and controls. Continuously update your FedRAMP knowledge to advise the organization of new requirements, guidelines, and controls. + Conduct internal FedRAMP readiness assessments to identify and remediate gaps or deficiencies prior to Third-Party Assessment Organizations (3PAOs) assessments + Coordinate FedRAMP readiness assessments with 3PAOs + Develop and maintain essential FedRAMP compliance documentation (System Security Plans (SSPs), Security Assessment Reports (SARs), and Plan of Actions and Milestones (POA&Ms). + Assist with remediating any findings identified during FedRAMP assessments and preparing for audits by the Federal government or authorized entities. + Act as a liaison with the FedRAMP program office to facilitate effective communication and compliance alignment. * **ISSO Tasks:** + Develop a real-time risk management system that fosters collaboration and enhances security practices within the organization. + Conduct regular security risk analyses for hospitals and healthcare systems to identify vulnerabilities and mitigate potential threats. + Provide daily advisory support to the National Security Director, addressing security concerns and participating in the implementation of a robust incident response program. + Stay abreast of Healthcare IT technologies and apply NIST 800 series methodologies to safeguard them effectively. + Train and mentor IT Security Team members, equipping them with the knowledge and skills needed to perform their roles efficiently. + Provide technical leadership to accreditation assessors and ISSOs. + Conduct analysis of current environment and provide recommendations to align accreditation processes with NIST and RMF guidance + Create and maintain information security policies in compliance with NIST and HIPAA regulations. + Utilize Archer to develop and maintain system accreditation lifecycle workflows and ATO packet management processes. + Conduct comprehensive security control assessments following NIST, IHS, and CISA guidelines * **Risk and Compliance Management:** + Conduct security risk analyses for current and emerging systems + Provide expert recommendations to the Approval Official regarding network and system authorizations. + Coordination of risk assessment and compliance activities between R&C and ISSO teams. + Conduct comprehensive assessments of security controls for IHS systems and sites, following NIST and CISA guidelines and ensuring adherence to risk management practices. + Offer guidance and advice on risk management techniques, procedures, and best practices to subordinate commands. + Act as Lead consultant for security control assessors and ISSO coordination, develop the processes and document standard procedures, fostering a collaborative and high-performing work environment. + Provide expert recommendations to the Approval Official (AO) regarding the authorization of organizations' networks and systems on IHS networks. + Thoroughly review system and site artifacts to verify compliance with NIST RMF requirements and identify potential areas for improvement. + Utilize network scanning and patching tools to mitigate vulnerabilities and enhance system security. + Prepare and present Approval to Operate (ATO) or Interim Approval to Test (IATT) documents, ensuring compliance with assessment requirements and CATOs. + Stay current with relevant NIST publications, NIST, CISA and IHS standards, and other guidelines. + Contribute to the development of policies, procedures, and methodologies that align with NIST RMF and support the organization's transition to these frameworks. + Train new security control assessors and other team members, ensuring they possess the necessary skills and knowledge to excel in their roles. + Utilize network scanning and patching tools to mitigate vulnerabilities and enhance system security. + Conduct staff assistance visits and annual FISMA security control assessments for DRSN sites, providing valuable insights and recommendations for improvement. + Manage deliverables, coordinate briefings, and oversee staff visits using effective project management practices. + Provide expert advice and produce necessary artifacts to ensure ongoing compliance with NIST RMF requirements and maintain a robust security posture. + Experience leading large projects in a Federal healthcare environment + Ability to coordinate risk assessment and compliance activities between GRC and ISSO teams + Provide leadership and guidance to ISSO and GRC teams + Expert level knowledge of RMF process, accreditation assessments, and DISA-STIGs for both on premises and cloud environments + Excellent communication and briefing skills to communicate to client leadership + Conduct regular security risk analyses for healthcare systems to identify vulnerabilities and mitigate potential threats. + Managing vulnerability remediation activities, ensuring their timely and effective resolution. + Coordinating external penetration testing to identify security weaknesses and collaborate with internal stakeholders for remediation activities + Conduct comprehensive vulnerability assessments to identify potential weaknesses within the organization's systems and infrastructure + Develop robust risk assessment methodologies aligned to NIST, FedRAMP, and HIPPA requirements and assist ISSO and Risk and Compliance team to implement the solution. + Continuously monitor and track risk mitigation efforts, update risk registers, and provide risk management guidance to maintain a resilient security posture. + Overseeing continuous monitoring processes; crafting and maintaining essential security metrics; and staying vigilant against emerging threats in the ever-evolving threat landscape, and train ISSO team and GRC team to work to the level they can perform their tasks independently. + Ensure compliance with relevant regulations and standards to provide guidance to system owners on the selection and implementation of appropriate security controls. + Support vulnerability management through regular assessments and compliance reporting. + Experience with Tenable to request ad-hoc scans, review reports, and provide analysis to stakeholders. + Provide input to the design and delivery training programs to educate system owners and employees on risk management, compliance, and security best practices to foster and maintain a comprehensive and proactive security culture. **Qualifications:*** Years of Experience: 10+ Years Relevant Experience* Education Level: Bachelor’s Degree; Master’s Degree preferred* Clearance Requirements: Public Trust* Certification Requirements: CISSP* Any other work-related qualifications needed for the role: + Experience leading large projects in a Federal healthcare environment. + Strong knowledge and understanding of HIPAA, PII, NIST, FISMA, and FedRAMP. + Proficiency with Nessus and Archer GRC (2 years desired). + Expert knowledge of RMF, NIST, accreditation assessments, and DISA-STIGs. + Excellent communication and briefing skills for client leadership.