ISSO Analyst

The ISSO Analyst role at EY supports Information System Security Officer (ISSO) and Security Control Assessment (SCA) activities across the NIST Risk Management Framework (RMF) lifecycle for federal information systems. The position centers on maintaining authorization documentation, building evidence packages mapped to NIST controls, supporting assessment readiness, and managing POA&M remediation and continuous monitoring tasks.

• Location: San Antonio, TX
• Work model: Hybrid

• Estimated salary: USD 73, per year

• Support RMF delivery for assigned federal information systems by maintaining documentation and tracking actions, assisting system owners and government security personnel with authorization activities.
• Support RMF Prepare by maintaining system information, stakeholder lists, asset and component inventories, authorization boundary information, data-flow documentation, interconnections, and risk context.
• Assist with information-type identification, NIST SP 800-60 mapping, and FIPS 199 security categorization, and document rationale and supporting information for review.
• Support control baseline selection and tailoring by documenting overlays, scoping decisions, organization-defined parameters, common controls, and system-specific responsibilities.
• Draft and update authorization artifacts, including System Security Plans, control implementation statements, inventories, diagrams, assessment-readiness materials, and supporting appendices.
• Collect, organize, and map evidence (policies, procedures, configurations, screenshots, tickets, scan outputs, and other materials) to applicable NIST SP 800-53 controls and assessment objectives.
• Review implementation statements and evidence for completeness, consistency, and traceability, and elevate gaps or conflicting information to senior team members.
• Prepare evidence packages, interview materials, document-request trackers, and response logs to support security control assessments.
• Participate in evidence-gathering sessions and control interviews with system owners, engineers, application teams, and assessors, capturing decisions, action items, and follow-up requests.
• Assist with drafting assessment responses, findings, risk statements, and corrective actions while preserving assessment independence.
• Create and maintain POA&M records, including weaknesses, responsible parties, milestones, scheduled completion dates, remediation evidence, and closure documentation.
• Track POA&M progress, follow up on overdue actions, validate evidence submissions, and elevate schedule or risk issues.
• Execute continuous monitoring, including scheduled control reviews, vulnerability and configuration reporting, evidence refreshes, and recurring status deliverables.
• Support security impact analyses for proposed system changes by documenting affected components, controls, evidence, and authorization artifacts.
• Review vulnerability scan results, STIG or CIS benchmark results, and configuration data; connect technical findings to NIST controls and remediation activities.
• Maintain accurate system records, workflows, and authorization artifacts in federal governance, risk, and compliance tools such as eMASS, JCAM, CSAM, or Xacta.
• Perform first-level quality checks using established templates and checklists to identify missing information, inconsistent dates, unsupported conclusions, and formatting issues.
• Track assigned deliverables and commitments, communicate progress clearly, and elevate blockers or emerging risks promptly.
• Collaborate with engagement team members and client stakeholders, incorporate feedback, and complete assigned work within expected time frames.
• Stay current on federal cybersecurity requirements and continue…