Information System Security Officer; ISSO Lead; Remote

The following states/districts are excluded from this job ad: AK, CA, CO, CT, DC, HI, LA, MA, MN, MO, NE, NV, NH, NJ, NM, NY, ND, OR, PR, RI, VT, WA, WY

Future Need
- Actively Interviewing

Location: Remote in any United States jurisdiction not excluded from this job advertisement.

Lead the authorization integrity of one of the Department of Veterans Affairs (VA's) most complex multi-tenant cloud platforms. As the Information System Security Officer (ISSO) Lead, you will manage Authorization to Operate (ATO)/Approval to Connect (ATC) sustainment, security audits, and continuous monitoring across a platform undergoing active authorization boundary restructuring.

• Initiates actions required to establish new ATOs and ATCs
• Maintains all existing authorizations including periodic assessment oversight and staffing of all ATO audits
• Coordinates all RMF activities with the AO, ISSO counterparts, ISO, and designated stakeholders
• Attends or conducts all security audits including General (IG), Security Assessment and Validation Data (SAVD), Cybersecurity Compliance Task Force (CCTF), Office of Information Security (OIS), Information Security Risk Management (ISRM), Governance Risk and Compliance (GRC), and Information Security Policy & Strategy (ISPS) assessments
• Attends closeout meetings and reviews all reported findings for accuracy
• Drafts assessment finding mitigation plans including roadmap and timeline
• Submits Plans of Action and Milestones (POA&M) for all prescribed remediations
• Maintains program security documents, diagrams, and artifacts required for ATO/ATC upkeep including PTA, PIA, SIA, BIA, DSC, hardware lists, software lists, and PPSM documents
• Collaborates with application development teams and platform architects to establish and maintain Interconnection Diagrams (ICD), High Level Diagrams (HLD), and security assessment boundary diagrams
• Supports the Multi-Tenant Platform Evolution Strategy ensuring ATO inheritance frameworks and authorization boundaries between platform and tenant layers are clearly defined
• Ensures no lapse in ATO status for any platform capability, service, or hosted application
• Contributes to the monthly RMF, security, and ATO status report including authorization posture, renewal timelines, and control implementation status

The annual projected pay range for this position is $111,776 - $164,390 with consideration being given to various factors including but not limited to qualifications, experience, job responsibilities, and geographic location.

• Medical, dental, vision and prescription drug coverage for you and your family.
• Life Insurance, short-term disability and long-term disability paid for by the Company.
• Supplemental coverages including Accident, Critical Illness, and Hospital.
• Additional Life insurance coverage for you and your dependents.
• 401k plan with various options to select based on your retirement goals.

All qualified applicants will receive consideration for employment without regard to any status protected by applicable federal, state, or local law.

10 years of experience in information systems security

Bachelor's Degree in cybersecurity, information assurance, or related field;
Certified Information Systems Security Professional (CISSP) or Certified Authorization Professional (CAP) (preferred)

• Expert knowledge of National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) process (e.g., Categorize, Select, Implement, Assess, Authorize, and Monitor)
• Excellent ability to initiate actions required to establish new ATOs/ATCs
• Excellent ability to maintain existing authorizations
• Excellent ability to attend or conduct security audits
• Excellent experience drafting assessment finding mitigation plans
• Excellent knowledge of multi-tenant ATO inheritance frameworks
• Excellent ability to support authorization boundary management between platform and tenant layers
• Above average ability to maintain security documentation (e.g., Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA), Security Impact Analysis (SIA),…