Information Systems Security Officer (ISSO) – Intermediate Level
- Compensation
- Not disclosed
- Location
- Washington, DC
- Work setup
- Hybrid
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 6+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor’s degree in Computer Science, Information Systems, or a related cybersecurity field. (Or 6 years of work experience equivalency in addition to that listed below)
- Minimum of 10 years of experience in ISSO, information assurance, or RMF roles
- Direct experience developing ATO packages (SSP, POA&M, SAR)
- Strong knowledge of NIST SP 800-53, FISMA, and RMF requirements
- Demonstrated ability to manage multiple systems (4-6 simultaneously)
- An active DoD clearance is required for this role
Nice to have
- Experience with cloud-based systems (SaaS, IaaS, PaaS) from major providers such as AWS, Azure, or GCP
- Experience using Microsoft and Google Suite tools
- Familiarity with AI tools such as Gemini, ChatGPT etc.
- Familiarity with Archer or CSAM platforms
- Relevant certifications (one required): CISSP, CISM, CISA, CRISC, CGRC
- Experience supporting federal civilian agencies. Active Public Trust clearance
Full description
Tangent Technologies is seeking a skilled, intermediate Information Systems Security Officer (ISSO) to support a federal program. The ISSO will ensure ongoing security, compliance, and risk management of information systems. This role is critical in the development and implementation of system security documentation and procedures, which are required to obtain and maintain an Authority to Operate (ATO).
In this position, the ISSO will serve as a trusted security advisor, ensuring compliance with federal standards including NIST, FISMA, FedRAMP, and the Risk Management Framework (RMF). The ISSO will also help implement effective continuous monitoring practices for assigned systems.
Candidates should be proactive, detail-oriented, and possess strong communication skills for client engagement.
This position is a hybrid role, with some onsite work required.
Key Responsibilities
- System Authorization: Lead the development, review, and maintenance of System Security Plans (SSPs) and authorization packages.
- Security Assessment & Authorization (A&A): Lead the preparation of ATO packages, including System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), Security Assessment Reports (SARs), and supporting documentation. Guide systems through the ATO lifecycle and continuous authorization processes, ensuring compliance with NIST SP 800-53, FISMA, and RMF standards.
- Risk Mitigation & Management: Conduct Security Impact Analyses (SIA) for system changes, develop mitigation strategies for identified vulnerabilities, and collaborate with system engineers to maintain secure system baselines. Conduct regular security audits, oversee scanning operations (e.g., ACAS, Nessus), and manage Plan of Action and Milestones (POA&Ms) for remediation.
- Compliance Enforcement & Governance: Perform self-assessments, risk assessments, and annual testing of Contingency Plans and Incident Response Plans. Ensure systems adhere to strict federal, Department of Defense (DoD), or Intelligence Community frameworks (e.g., NIST SP 800-53, FISMA).
- Continuous Monitoring: Review audit logs, analyze vulnerability scans, and evaluate system-level reports to ensure the effectiveness of security controls. Implement security telemetry, manage patch statuses, and monitor system activities for anomalous behavior or potential threats.
- Advisory: Provide strategic risk and compliance advice to system owners and Information System Security Managers (ISSMs).
- Technical Knowledge: Demonstrate expertise in network security, cloud environments (including containers and architectures), operating systems, and security assessment tools.