Senior Information System Security Officer (ISSO)
SalaryNo pay range posted
LocationCustomer Site, Washington, D.C.
Work modeon-site
Typefull-time
SenioritySenior
Experience7+ yrs
DepartmentCybersecurity
Company size201–500 people
PostedAug 28, 2026 · 1mo ago
Verified live21h ago
At a glanceSummarised by Seekless from the posting.
Minimum seven (7) years of cybersecurity
Minimum five (5) years in federal RMF, A&A, ISSO, or authorization work
Working knowledge of NIST SP 800-37, 800-53, 800-53B, FIPS 199, FISMA, and applicable CISA/OMB guidance
Familiarity with GRC, ITSM, SIEM, scanner, identity, endpoint and cloud-security platforms
Hands-on CSAM experience supporting system profiles, controls, evidence, POA&Ms, and authorization workflows
Experience with Azure Government, Microsoft 365 GCC/GCC High, and cloud shared-responsibility models
Experience with Entra ID, Okta, privileged access, role assignments, and access recertification
Associate's degree in Cybersecurity, Information Technology, or related field (relevant experience may be considered in lieu)
At least one current cybersecurity certification such as CISSP, CGRC, CISM, CRISC, Security+, SecurityX, CCSP, or GIAC
U.S. Citizenship
Eligibility to obtain a Tier 4 High-Risk Public Trust
Skills
CSAM
RMF
FedRAMP
Azure Government
Microsoft 365 GCC
Microsoft 365 GCC High
Entra ID
Okta
NIST SP 800-37
NIST SP 800-53
NIST SP 800-53B
FIPS 199
GRC
ITSM
SIEM
cloud-security platforms
**CONTINGENT UPON CONTRACT AWARD**
Overview:
Job Title: Senior Information System Security Officer (ISSO)
Requirements
Security Clearance: Ability to Obtain Tier 4 High-Risk Public Trust
Location: Washington, D.C.
(Due to the nature of the work and contract requirements, U.S. Citizenship is required.)
Description:
C3EL is seeking a Senior Information System Security Officer (ISSO) to provide on-site cybersecurity and Risk Management Framework (RMF) sustainment support in Washington, D.C., for a new contract. This role will serve as the primary Alternate Lead, with deep CSAM, RMF, authorization, FedRAMP, cloud, identity, and assessment expertise, being capable of assuming Lead ISSO duties without service degradation for the program.
Responsibilities will include, but not be limited to:
•
Provide on-site cybersecurity and RMF sustainment support.
•
Independently manage categorization, control selection, implementation evidence, assessment readiness, authorization, and monitoring.
•
Develop and maintain SSPs, SAPs, SARs, POA&Ms, risk assessments, control statements, inheritance records, and evidence packages.
•
Support FedRAMP-authorized cloud services, provider artifacts, customer responsibilities, CRMs, SRMs, and inherited controls.
•
Support privacy controls, PTAs, PIAs, and systems processing PII.
•
Pre-stage evidence and coordinate SCA interviews, walkthroughs, demonstrations, findings, and comment adjudication.
•
Track ATO dates, conditions, milestones, open risks, and briefing materials for AO/AODR decisions.
•
Produce accurate, concise, and audit-ready Government cybersecurity documentation.
•
Support team coverage from 7:00 a.m. to 6:00 p.m. ET (M-F) and participate in after-hours incident coverage as needed.
Minimum Qualifications:
•
U.S. Citizenship.
•
Eligibility to obtain a Tier 4 High-Risk Public Trust.
•
Minimum seven (7) years of cybersecurity.
•
Minimum five (5) years in federal RMF, A&A, ISSO, or authorization work.
•
Working knowledge of NIST SP 800-37, 800-53, 800-53B, FIPS 199, FISMA, and applicable CISA/OMB guidance.
•
Familiarity with GRC, ITSM, SIEM, scanner, identity, endpoint and cloud-security platforms.
•
Hands-on CSAM experience supporting system profiles, controls, evidence, POA&Ms, and authorization workflows.
•
Experience with Azure Government, Microsoft 365 GCC/GCC High, and cloud shared-responsibility models.
•
Experience with Entra ID, Okta, privileged access, role assignments, and access recertification.
Preferred Qualifications:
•
At least one current cybersecurity certification such as CISSP, CGRC, CISM, CRISC, Security+, SecurityX, CCSP, or GIAC.
Education:
•
Associate’s degree in Cybersecurity, Information Technology, or related field. (Relevant experience may be considered in lieu of formal education.)