Lead Information System Security Officer (ISSO)

• Direct ISSO activities across the full compliance lifecycle: program governance, Risk Management Framework and authorization support, continuous monitoring, vulnerability and POA&M management, security documentation, security impact analysis and change coordination, incident response coordination, and audit and assessment support
• Oversee development, quality control, and submission of authorization packages in CSAM
• Chair internal quality reviews of every deliverable before it goes to the government
• Maintain personal hands-on proficiency across CSAM, ServiceNow, Splunk, and enterprise vulnerability scanning platforms

• Serve as the primary technical interface with the government ISSM, CISO, Authorizing Official and designated representatives, System Owners, and Common Control Providers
• Represent the team in agency governance forums including the Enterprise Review Board, Change Control Board, Cybersecurity Steering Committee, Risk Management Working Group, and Privacy Working Group
• Prepare and present authorization decision briefings to federal leadership
• Escalate risks and issues to government leadership with a recommended course of action attached

• Maintain the risk and issue register and drive items to documented closure
• Produce weekly activity reports, monthly program status reports, and quarterly executive review materials
• Track and report service-level and key-performance-indicator results across every work area
• Coordinate with corporate program management on staffing, reporting, and invoicing

• Meet rapid-response commitments, including four-hour notification on known exploited vulnerabilities, one-business-day triage of critical findings, and one-hour incident acknowledgment during core hours
• Monitor first-time acceptance rates on deliverables and drive corrective action on any nonconformance
• Keep records audit-ready between audits, so evidence can be produced without a scramble

• Bachelor’s degree in cybersecurity, computer science, information systems, or a related technical discipline
• Minimum 10 years of cybersecurity experience
• At least 5 years in ISSO, ISSM, or Risk Management Framework-centric roles supporting federal information systems
• Demonstrated experience leading RMF authorization efforts under NIST SP 800-37 Revision 2, including System Security Plans, security assessment plans and reports, and POA&M lifecycle management
• Experience presenting to and coordinating with federal governance bodies and authorizing officials

• CISSP or CISM, or a comparable advanced security certification

• Hands-on experience with a federal governance, risk, and compliance platform. CSAM strongly preferred; eMASS, ArchAngel, or a comparable platform considered where you can demonstrate the ability to transition to CSAM
• Working proficiency with ServiceNow, Splunk, and an enterprise vulnerability scanner such as Tenable Nessus or Qualys
• Working knowledge of NIST SP 800-53, NIST SP 800-137, FIPS 199, and CISA Binding Operational Directive requirements including the Known Exploited Vulnerabilities catalog
• Federal-quality technical writing that an authorizing official or independent assessor can rely on without follow-up

• Track record of directing technical staff and holding a team to measurable service levels
• Ability to translate technical risk into terms federal executives can act on
• Sound judgment about the boundary between contractor recommendation and government decision authority

• FedRAMP inherited-control documentation experience, including Customer and Shared Responsibility Matrix reconciliation
• Microsoft Azure Government and Microsoft 365 GCC/GCC High experience
• Zero Trust architecture experience
• Privacy documentation experience, including Privacy Threshold Analyses and Privacy Impact Assessments
• Prior experience supporting a small federal agency or a CISO organization
• Current or recent Tier 4 High-Risk Public Trust adjudication, or higher

• Authorization artifacts accepted by the government on first submission
• Service-level and key-performance-indicator targets met across every work area
• Federal stakeholders able to make risk decisions without having to come back for more information
• A portfolio that stays audit-ready between audits

• Based in the Washington, DC metropolitan area. This position requires regular in-person presence at DFC headquarters at 1100 New York Avenue NW for governance forums, authorization briefings, and audit and assessment activity, with remote work between those commitments.
• Authorization to work in U.S. without restriction.
• Must be eligible for and able to obtain a Tier 4 High-Risk Public Trust background investigation. Adjudication must be complete before privileged access to enterprise security tools or authorization repositories is granted.
• Must obtain and maintain an agency-issued PIV card.
• Must complete agency cybersecurity, privacy, records management, insider threat, and applicable role-based training on entry and annually thereafter.
• Availability during core business hours, 7:00 a.m. to 6:00 p.m. Eastern, Monday through Friday, excluding federal holidays, and participation in a shared on-call rotation for off-hours incident acknowledgment.

• $137,000.00 - $147,000.00 salary commensurate with experience and qualifications.
• This position is contingent upon contract award.

Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.