Position Overview
SecurePro is seeking experienced Lead and Senior Information System Security Officers (ISSOs) to support a federal cybersecurity program in Washington, DC. The team will provide ISSO support across a portfolio of approximately 32 FISMA Moderate information systems, including Risk Management Framework (RMF) and authorization activities, continuous monitoring, vulnerability management, POA&M execution, security documentation, security impact analysis, incident coordination, and audit support.
This is a hands-on, on-site position supporting a federal environment. Candidates will be considered for either the Lead ISSO or Senior ISSO role based on experience and qualifications.
Key Responsibilities
- Execute the NIST SP 800-37 Rev. 2 RMF lifecycle for FISMA Moderate systems.
- Develop, maintain, review, and quality-control authorization packages including SSPs, SARs, RARs, POA&Ms, security controls, and assessment evidence.
- Manage POA&Ms from finding identification through validated closure.
- Perform continuous monitoring and vulnerability analysis.
- Verify security logging and audit coverage using Splunk.
- Maintain authorization and compliance information in CSAM as the authoritative GRC platform.
- Maintain ticket-to-POA&M traceability using ServiceNow.
- Perform Security Impact Analyses for system and infrastructure changes.
- Coordinate cybersecurity incident response activities and corrective actions.
- Support FISMA audits, Inspector General reviews, independent assessments, and evidence requests.
- Review inherited and common controls for AWS and Azure environments.
- Participate in Change Advisory Boards, Change Control Boards, Enterprise Review Boards, and cybersecurity governance forums.
- Coordinate with federal ISSMs, CISOs, Authorizing Officials, System Owners, and other cybersecurity stakeholders.
Lead ISSO Responsibilities
The Lead ISSO will serve as the primary technical lead for the engagement and will:
- Direct Senior ISSO workstreams and authorization schedules.
- Perform quality reviews before cybersecurity deliverables are submitted to the Government.
- Own cybersecurity risk and issue tracking and escalation.
- Prepare Authorizing Official decision briefings.
- Lead responses to audits, IG reviews, and independent assessments.
- Provide technical direction to other ISSOs while maintaining responsibility for an assigned system portfolio.
Required Qualifications — All Candidates
- U.S. citizenship required.
- Ability to obtain and maintain a Tier 4 High Risk Public Trust.
- Hands-on experience with CSAM supporting federal authorization and RMF activities.
- Experience executing NIST SP 800-37 Rev. 2 RMF for FISMA Moderate systems.
- Hands-on ownership of the POA&M lifecycle through validated closure.
- Working proficiency with Splunk and ServiceNow.
- Experience developing and maintaining federal cybersecurity documentation.
- Ability to work on-site in Washington, DC, five days per week.
- Knowledge of NIST SP 800-53 security controls and federal cybersecurity requirements.
Lead ISSO Qualifications
- 10+ years of federal cybersecurity experience.
- 8+ years of federal ISSO, RMF, or Assessment & Authorization experience.
- 5+ years providing technical direction to other ISSOs.
- Demonstrated experience working directly with federal ISSMs, CISOs, Authorizing Officials, or AODRs.
- Experience reviewing and approving SSPs, SARs, RARs, POA&Ms, and assessment evidence.
- Experience leading FISMA audits, Inspector General reviews, or independent security assessments.
- Working knowledge of CSAM System Inventory, A&A/ATO, SSP/Security Controls, Assessments, Common Control/Inheritance, POA&M, and Continuous Monitoring modules.
- At least one active certification: CISM, CISSP, or CISA.
Senior ISSO Qualifications
- 6–8+ years of federal cybersecurity experience, depending on position level.
- 4–5+ years of ISSO, RMF, or federal authorization experience.
- Experience with continuous monitoring, vulnerability management, security documentation, incident coordination, or Security Impact Analysis.
- Experience with vulnerability platforms such as Tenable Nessus, Qualys, or ACAS.
- Experience validating Splunk log-source coverage, retention, and audit-trail completeness.
- Experience authoring SSPs, control implementation statements, system boundary/data-flow documentation, and control inheritance records.
- At least one active certification such as CISM, CISSP, CISA, or CASP+.
- Candidates considered for the Alternate Lead role must have experience assuming lead responsibilities, including briefings, prioritization, and artifact approval.
Preferred Qualifications
- Active federal Public Trust or security clearance.
- CISA certification.
- AWS or Azure cloud certification.
- AWS GovCloud or Azure Government experience.
- FedRAMP shared-responsibility and control-inheritance experience.
- NIST SP 800-53 Rev. 4 to Rev. 5 transition experience.
- Microsoft Defender, Intune, BigFix, Palo Alto, Zscaler, Okta, or Entra ID experience.
- CyberScope and federal FISMA reporting experience.
- NIST SP 800-128 Security Impact Analysis experience.
- Container, Kubernetes, or DevSecOps exposure.
- Experience supporting federal audit, penetration testing, or Inspector General activities.
Work Environment
The engagement supports a hybrid federal technology environment that may include Azure Government, Microsoft 365 GCC/GCC High, Entra ID, Okta, Palo Alto, Zscaler, Tenable or Qualys, Microsoft Defender, Intune, BigFix, Splunk, ServiceNow, and CSAM.
This position is on-site in Washington, DC and is not remote or hybrid.
SecurePro is an equal opportunity employer. Employment for these positions is contingent upon contract award and successful completion of applicable federal suitability and onboarding requirements.
