Information System Security Officers; ISSO

Location: Remote
Clearance Requirement: Active Secret
Employment Type: Full-Time

Disruptive Solutions, a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering mission-focused cybersecurity and technology solutions for federal and commercial clients. We specialize in advanced cybersecurity operations, AI/ML integration, cloud modernization, data governance, and risk management. With a proven track record supporting agencies like the Department of Defense (DoD), Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury, we deliver innovative solutions that maximize efficiency and strengthen cyber resilience.

At our core, we are dedicated partners committed to securing the mission with innovation, integrity, and measurable impact.

Disruptive Solutions is seeking multiple experienced Information System Security Officers (ISSO) to support cybersecurity and information assurance activities for State. The ISSO will provide hands-on cybersecurity support for assigned information systems throughout the system lifecycle, maintaining visibility into authorization status, security posture, vulnerabilities, and cybersecurity risk. The candidate will work closely with ISSMs, system owners, security engineers, SCAs, technical teams, and other stakeholders to maintain system authorizations and ensure compliance with federal and State cybersecurity requirements.

• Serve as the ISSO for assigned State information systems and support cybersecurity activities throughout the complete system lifecycle.
• Execute and support all phases of the NIST Risk Management Framework (RMF) and system authorization process.
• Maintain accurate information regarding system lifecycle stage, authorization status, ATO expiration, security controls, vulnerabilities, and overall risk posture.
• Develop, maintain, and update RMF and authorization documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), POA&Ms, risk assessments, contingency plans, incident response plans, and supporting security artifacts.
• Support system categorization, security control selection and tailoring, inherited controls, control implementation, assessment, authorization, and continuous monitoring activities.
• Coordinate with system owners and technical teams to obtain, review, and validate security control implementation evidence.
• Maintain version control and quality of RMF documentation and supporting security artifacts.
• Prepare systems for independent Security Control Assessments (SCAs), including implementation readiness activities and collection and validation of supporting evidence.
• Identify, document, track, and manage cybersecurity risks, vulnerabilities, and remediation activities through the POA&Ms lifecycle.
• Review vulnerability and compliance findings from Tenable, Wiz/cloud security platforms, iPost, and comparable security technologies and translate technical findings into risk and remediation activities.
• Track vulnerability findings and support remediation in accordance with applicable CISA Binding Operational Directives (BODs), Known Exploited Vulnerabilities (KEV), STIGs, and State requirements.
• Support continuous monitoring activities to ensure systems maintain an acceptable security posture and authorization documentation remains current.
• Support FISMA metrics, annual FISMA reviews, cybersecurity audits, data calls, and compliance reporting.
• Develop and maintain supporting security artifacts such as evidence indexes, inherited control matrices, system boundary and data-flow…