Senior ISSO: Security Risk & Compliance Lead

UNAVAILABLE; McLean (VA); On-site; USD 140,000 - 180,000; Full time

Job summary

Steampunk seeks a Senior Information System Security Officer (ISSO) to support a government customer on site in the Washington DC area. The ISSO will maintain the security authorization and manage risk, coordinating with cross-functional teams to remediate POA&Ms and uphold authorized security levels.

Ideal candidates have 5–10 years IA experience with FISMA, NIST RMF, and DHS guidance, plus certifications such as CISSP/CISA/CISM.

Qualifications

• 5–10 years of IA experience required, with 3+ years FISMA-related
• Bachelor's Degree in IT or related field, or 4+ years of FISMA experience in lieu of degree
• Certifications such as CISSP, CASP, CISA, CEH or CISM preferred
• Specialized knowledge of NIST SP 800 RMF and security controls
• Experience with vulnerability management and security authorization processes

Responsibilities

• Create Waivers or Risk Acceptance Memos for risk management
• Conduct annual assessments per DHS guidance
• Review and update security authorization documents annually
• Coordinate with customer divisions on compliance documentation
• Perform Contingency Plan tests annually and update plans
• Support ISVM/Patch Management activities
• Provide audit support across multiple standards and audits
• Maintain inventory of accreditation boundary
• Incorporate security requirements into development lifecycles (Waterfall, Agile, DevSecOps)
• Ensure CM processes prevent new security risks
• Respond to evolving security policies and regulations
• Participate in DevOps Security requirements for systems

Skills

IA experience

FISMA experience

NIST RMF knowledge

Security controls evaluation

Education

Bachelor's Degree in IT/related field

4+ years FISMA-related experience in lieu of degree

Tools

CISSP/CISA/CISM/CET certifications

DHS/FISMA guidance familiarity

Job description

Steampunk seeks a Senior Information System Security Officer (ISSO) to support a government customer on site in the Washington DC area. The ISSO will maintain the security authorization and manage risk, coordinating with cross-functional teams to remediate POA&Ms and uphold authorized security levels.

Ideal candidates have 5–10 years IA experience with FISMA, NIST RMF, and DHS guidance, plus certifications such as CISSP/CISA/CISM.