Senior Information System Security Officer (ISSO)

• Maintain authorization packages, control implementation statements, inheritance records, and POA&M items in CSAM for assigned systems
• Develop and recommend system security categorizations and control baselines, documenting tailoring rationale
• Reconcile inherited controls against current cloud provider and common control provider documentation
• Keep records audit-ready and internally consistent between the compliance platform and supporting repositories

• Execute continuous monitoring plans: recurring security reviews, Splunk log ingestion verification, and monthly posture reporting
• Analyze vulnerability scan results from Tenable, Qualys, and Microsoft Defender; validate findings and document false-positive rationale with supporting evidence
• Coordinate remediation with engineering teams and track POA&M items to closure with bidirectional ServiceNow traceability
• Produce monthly reporting that gives federal stakeholders analysis and recommended action, not raw data extracts

• Prepare security impact analyses for change requests within contract turnaround times
• Support change advisory and change control board meetings, and perform post-change verification
• Analyze proposed changes for significant-change implications and prepare the resulting assessment packages

• Provide ISSO-side incident response coordination: affected-system context from CSAM within one business hour of declaration, situation reports, root cause analysis inputs, and corrective action tracking
• Support audits, assessments, and FISMA reporting through evidence staging, auditor coordination, draft finding responses, and corrective action plans

• Step into Lead ISSO duties during planned and unplanned absences without a drop in service
• Represent the team in agency governance forums when the Lead is unavailable
• Lead internal quality reviews of deliverables when acting in the Lead role

• Monitoring and Remediation: primary owner of continuous monitoring and security posture management and of vulnerability and POA&M execution, and the coordination point for incident response
• Authorization and Assurance: primary owner of security documentation and artifact management, security impact analysis and change coordination, and audit, assessment, and compliance support, working alongside the Lead ISSO on authorization efforts. Depth in CSAM is prioritized for this position.

• Bachelor’s degree in cybersecurity, computer science, information systems, or a related technical discipline
• Minimum 8 years of ISSO, security control assessment, or Risk Management Framework experience supporting federal information systems
• Demonstrated production of RMF artifacts: System Security Plans, control implementation statements, assessment evidence, and POA&Ms
• Readiness to assume Lead ISSO responsibilities, including governance-forum representation and internal quality review leadership

• CISSP, CGRC (formerly CAP), or CASP+, or a comparable certification

• Hands-on proficiency with CSAM. A comparable federal governance, risk, and compliance platform such as eMASS or ArchAngel considered where you can demonstrate the ability to transition to CSAM
• ServiceNow, Splunk, and at least one enterprise vulnerability scanner
• Working knowledge of NIST SP 800-37 Revision 2, NIST SP 800-53, and NIST SP 800-137
• Clear technical writing that stands up to federal review without rework

• FedRAMP shared-responsibility documentation experience
• Microsoft Azure Government and Microsoft 365 GCC High familiarity
• Privacy documentation support, including Privacy Threshold Analyses and Privacy Impact Assessments
• Experience with Microsoft Defender for Endpoint, Identity, and Cloud
• Current or recent Tier 4 High-Risk Public Trust adjudication, or higher

• Authorization records for assigned systems accurate, current, and internally consistent
• Findings triaged and reported inside contract turnaround times
• Monthly reporting federal stakeholders can act on directly
• Able to cover the Lead role on short notice without a dip in service

• Primarily remote, with in-person presence required at DFC headquarters in Washington, DC on an as-needed basis for governance meetings, audits, and assessments. Candidates based in the Washington, DC metropolitan area are preferred.
• Authorization to work in U.S. without restriction.
• Must be eligible for and able to obtain a Tier 4 High-Risk Public Trust background investigation. Adjudication must be complete before privileged access to enterprise security tools or authorization repositories is granted.
• Must obtain and maintain an agency-issued PIV card.
• Must complete agency cybersecurity, privacy, records management, insider threat, and applicable role-based training on entry and annually thereafter.
• Availability during core business hours, 7:00 a.m. to 6:00 p.m. Eastern, Monday through Friday, excluding federal holidays, and participation in a shared on-call rotation for off-hours incident acknowledgment.

• $99,000.00 - $109,000.00 salary commensurate with experience and qualifications.
• This position is contingent upon contract award.

Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.