Senior Information System Security Officer (ISSO)We are seeking a Senior Information System Security Officer (ISSO) to support mission-critical systems by executing RMF processes, maintaining system compliance, and enabling secure operations within a federal environment. This is a hands-on role focused on ATO support, vulnerability management, and continuous monitoring, working closely with engineering teams to ensure systems meet federal cybersecurity requirements.ResponsibilitiesExecute the Risk Management Framework (RMF) lifecycle, including control implementation, assessment, and authorization supportDevelop and maintain security documentation including System Security Plans (SSPs), POA&Ms, Security Assessment Reports (SARs), and risk assessmentsImplement and monitor NIST SP 800-53 security controls to support ATO and ongoing complianceConduct vulnerability scanning and assessments using tools such as ACAS, Nessus, SCAP, and STIG ViewerTrack and manage remediation of vulnerabilities (e.g., CVE/IAVM findings) in coordination with system administrators and developersSupport continuous monitoring activities, including audit log review, system auditing, and compliance validationReview and assess system changes, patches (WSUS), and deployments for security impactUtilize tools such as eMASS to manage system authorization packages and track compliance statusCollaborate with engineering and operations teams to ensure secure system configuration and hardening (STIGs)Support incident response coordination and contingency planning (e.g., COOP) as neededPrepare for and support security audits, inspections, and ATO reviewsRequired Skills & QualificationsStrong experience as an ISSO supporting federal systems (FBI/DoD/IC preferred)Hands-on experience with RMF (NIST SP 800-37) and NIST SP 800-53 controlsExperience developing and maintaining ATO documentation (SSP, POA&M, SAR, etc.)Proficiency with security tools such as ACAS, Nessus, SCAP Compliance Checker, STIG Viewer, and eMASSFamiliarity with vulnerability management processes (CVE, IAVM) and remediation trackingExperience with continuous monitoring, system auditing, and compliance reportingUnderstanding of system hardening, patching (WSUS), and secure configurations across Windows/Linux environments