Senior ISSO - RMF/ATO Expert for SCIF Systems

PROVATOHR INC; Reston (VA); On-site; USD 83,000 - 124,000; Part time

Job summary

PROVATOHR INC in Reston, VA seeks an Information System Security Officer (ISSO) to manage the Authorization to Operate lifecycle for classified systems in a SCIF environment. The role focuses on RMF governance, control enforcement, and compliance with ICD directives.

Responsibilities include developing SSPs, leading security assessments, monitoring vulnerabilities, and ensuring continuous authorization across the system.

Qualifications

• 5–8 years in ISSO/ISSM or equivalent
• Active TS/SCI with Full Scope Polygraph
• IC ISSO training program completion
• Strong experience with NIST RMF and ATO lifecycle
• Experience developing SSPs and security packages
• Knowledge of ICD 503, 704, 705
• Experience in SCIF environments
• Strong NIST 800-53 understanding
• Independent work in highly regulated environments
• Excellent documentation and audit readiness skills

Responsibilities

• Own the ATO lifecycle for classified systems
• Develop and maintain SSPs and RMF documentation
• Lead security assessments and authorization decisions
• Operate continuous monitoring programs
• Track vulnerabilities and remediation activities
• Ensure proper review and approval of system changes
• Maintain oversight of privileged access and security-relevant changes
• Collaborate with agency teams on secure system design and deployment

Skills

ATO lifecycle ownership

RMF governance

NIST 800-53 controls

SSP development

Certification & Accreditation

SCIF operations

Documentation & audit readiness

Independent decision making

Education

Bachelor's degree in Cybersecurity/IS/CS

Tools

ConMon

Job description

PROVATOHR INC in Reston, VA seeks an Information System Security Officer (ISSO) to manage the Authorization to Operate lifecycle for classified systems in a SCIF environment. The role focuses on RMF governance, control enforcement, and compliance with ICD directives.

Responsibilities include developing SSPs, leading security assessments, monitoring vulnerabilities, and ensuring continuous authorization across the system.