Principal Information System Security Officer

Columbia, MD

Clarity Innovations is a trusted national security partner, dedicated to safeguarding our nation’s interests and delivering innovative solutions that empower the Intelligence Community (IC) and Department of Defense (DoD) to transform data into actionable intelligence, ensuring mission success in an evolving world.

Our mission-first software and data engineering platform modernizes data operations, utilizing advanced workflows, CI/CD, and secure Dev Sec Ops  practices. We focus on challenges in Information Warfare, Cyber Operations, Operational Security, and Data Structuring, enabling end-to-end solutions that drive operational impact.

We are committed to delivering cutting-edge tools and capabilities that address the most complex national security challenges, empowering our partners to stay ahead of emerging threats and ensuring the success of their critical missions. At Clarity, we are people-focused and set on being a destination employer for top talent, offering an environment where innovation thrives, careers grow, and individuals are valued.

Join us as we continue to lead innovation and tackle the most pressing challenges in national security.

The ISSO supports the ISSM and owns the authorization documentation for this platform at the unclassified (CUI) classification level, across every development team on it. This is the single ISSO seat for that platform and classification combination at this time, and separate ISSOs cover the other environments. The ISSO is not embedded with any one team. Instead, the ISSO works with all of them, each with its own goals and priorities, and consolidates those into a single authorization package covering the entire platform.

The role centers on establishing and maintaining ATO packages and their associated artifacts, maintaining interconnection agreements (ISAs and related), and transitioning the package from NIST SP 800-53 Rev 4 to Rev 5. Initial scope is the unclassified (CUI) system only. As clearance and access are completed, the ISSO also provides surge support and backfill for the ISSOs of other environments, including leave coverage.

Success requires comfort switching context between teams, a commitment to keeping documentation accurate as the system changes, and interest in improving documentation and reporting through automation where practical.

Owns and maintains the authorization package and its body of evidence (BoE), including the SSP, control statement responses, and supporting artifacts, so that documentation reflects the current state of the system. eMASS is the system of record for the BoE and POA&Ms in this role.

Executes the package transition from NIST SP 800-53 Rev 4 to Rev 5 in coordination with the ISSM, using artifacts demonstrating compliance provided by security engineers and engineering development teams

Develops and maintains interconnection and boundary documentation, including ISAs and related agreements

Owns POA&M entries and milestone tracking, coordinating with security engineers and development teams on remediation artifacts and status

Prepares Con Mon documentation and reporting on schedule and ensures findings are accurately captured in the package

Maintains the SBOM and component version representation in the package, and validates components against CVE data and mitigation guidance. Where a component carries a vulnerability, identifies the required remediation (for example, moving to a fixed version or above) and communicates it to the owning team. Where a compensating control is proposed instead, participates in the architectural plan and in obtaining AO and government customer buy-in.

The role identifies vulnerabilities and required mitigations; it does not choose between alternative libraries or products.

Participates in the CCB, documenting the authorization impact of proposed changes and keeping the package aligned with approved changes, including filling in for the project ISSM on the unclassified system when the ISSM is unavailable. Contractor ISSOs and ISSMs do not accept new risk. They determine whether a proposal aligns with the current risk posture and refer anything outside it to the appropriate government authority.

Coordinates with security engineers for technical evidence, with development teams across the platform for artifacts, and with SCAs, AO staff, and government counterparts on documentation requests and findings

Drafts risk…