Senior Information Systems Security Officer

Senior Information Systems Security Officer

About APTNEXUS

Since our founding 2012, Apt Nexus has empowered federal agencies and commercial enterprises to navigate the complexities of the digital landscape. As a quality-driven small business, we specialize in the seamless delivery of IT modernization and elite cybersecurity solutions. We help our clients modernize and fortify their technology stacks, ensuring their most critical data and assets remain resilient, optimized, and secure in an evolving threat environment.

• Up to $150,000 per year based on experience.

• Onsite 5 days per week - Required per contract.

Apt Nexus is seeking an experienced Information Systems Security Officer (ISSO) to support our civilian agency customer. In this role, you will provide assigned ISSO support for agency systems throughout their lifecycle, performing daily, weekly, and continuous systems monitoring duties in alignment with the NIST Risk Management Framework (RMF), Departmental/Treasury policy, and Agency-specific cybersecurity requirements.

• Ensure applicable cybersecurity policies and controls are implemented for the agency’s existing and new systems, maintaining an operational security posture consistent with current policy.
• Serve as the principal advisor to the Authorizing Official (AO), System Owner (SO), and/or CISO on all matters (technical and otherwise) involving assigned system security.
• Develop and maintain a full suite of SA&A artifacts, including: FIPS 199 categorizations, System Security Plans (SSPs), Privacy Threshold Analyses (PTAs), Privacy and Civil Liberties Impact Assessments (PCLIAs), Contingency Plans (CP) and Contingency Plan Tests (CPTs), Business Impact Analyses (BIAs), Security Assessment Reports (SARs), IV&V Reports, Risk Acceptances, Waivers, MOUs/ISAs, and Deviations.
• Develop, update, and maintain Plan of Action & Milestones (POA&M) reports on a monthly basis and as directed, providing trending analysis and remediation recommendations. Monitor open POA&Ms to ensure timely resolution.
• Conduct daily continuous monitoring of agency systems to ensure compliance with all applicable requirements and generate associated reports.
• Coordinate with System Owners to ensure system security documentation is maintained and that changes to systems are evaluated for security impact through the agency change management process.
• Support the development, maintenance, and reporting of Authority to Test (ATT) and Security Impact Analysis (SIA) documentation on a monthly basis or as required.
• Ensure that system audit trails are regularly examined and anomalies are reported to the bureau CSIRC or other designated security officials.
• Support the implementation and ongoing authorization of agency systems using NIST SP 800-137 Rev-2 (ISCM) guidance, supporting the Bureau’s transition from time-based ATOs to Ongoing Authorization.
• Maintain and support 100% of the agency’s system ATOs in an active and compliant status at all times.
• Ensure documentation detailing IT hardware and software configuration and all security countermeasures are developed and maintained.
• Utilize the Agency’s Governance, Risk and Compliance (GRC) solution for development and maintenance of all required SA&A documentation.
• Analyze reports from security and privacy monitoring tools including vulnerability scanners, SIEM (Splunk/Elastic), Endpoint Detection and Response (EDR), CDM tools (Crowd Strike/Qualys), and coordinate corrective actions with IT team members.
• Support the agency in responding to audits, oversight reviews, and investigations from internal or external oversight organizations.
• Lead and coordinate the gathering of audit artifacts in response to Provided by Client (PBC) requests from the Office of Inspector General (OIG), GAO, and other internal and external oversight bodies; establish and maintain a PBC tracking matrix with artifact owners, due dates, and submission status to ensure complete and on-time responses.
• Analyze audit findings, Notices of Findings and Recommendations (NFRs), and corrective action requests; assess root cause, scope, and systemic risk; and develop technically accurate, fully…