Senior Information Systems Security Officer

Position Overview

Serves as DHS I&A's senior offensive security and technical assessment specialist. This position is responsible for identifying vulnerabilities, assessing system security posture, validating security control effectiveness, conducting penetration testing activities, evaluating software assurance risks, and providing actionable remediation recommendations across classified and unclassified environments.

Serves as the day‑to‑day cybersecurity lead for assigned systems and acts as the principal interface between system owners, program managers, system administrators, security engineers, ISSMs, security control assessors (SCAs), authorizing officials, and mandatory stakeholders. The mandate ensures systems remain compliant, authorized, and secure throughout their operational lifecycle.

• Manage cybersecurity activities for assigned systems.
• Ensure systems maintain compliance with DHS and Intelligence Community requirements.
• Monitor system security posture.
• Coordinate implementation of cybersecurity requirements.
• Provide ongoing security oversight throughout the system life cycle.

• Develop and maintain RMF documentation.
• Support Assessment & Authorization (A&A) activities.
• Maintain System Security Plans (SSPs).
• Assist with Security Assessment Reports (SARs).
• Manage Plan of Action and Milestones (POA&M) documentation.
• Support ATO and ongoing authorization efforts.
• Coordinate authorization package updates.
• The ISSO is typically the individual most directly responsible for maintaining authorization artifacts on a day-to-day basis.

• Execute continuous monitoring activities.
• Review vulnerability scan results.
• Track remediation actions.
• Monitor control effectiveness.
• Support recurring security assessments.
• Ensure systems remain compliant between authorization cycles.
• Report security posture changes to leadership.

• Track identified vulnerabilities.
• Coordinate remediation efforts with system administrators and engineers.
• Validate corrective actions.
• Maintain POA&M records.
• Monitor remediation timelines.
• Escalate unresolved cybersecurity risks.

• Support cybersecurity audits and inspections.
• Provide evidence supporting compliance assessments.
• Respond to auditor requests.
• Assist during FISMA reviews.
  
  Support OIG and Intelligence Community inspections.
• Maintain audit readiness documentation.

• Verify implementation of required security controls.
• Coordinate control testing activities.
• Support Security Control Assessors during assessments.
• Validate remediation of identified findings.
• Assist in maintaining compliance with NIST and Intelligence Community control requirements.

• Identify and document cybersecurity risks.
• Participate in risk assessments.
• Support risk mitigation planning.
• Monitor residual risk.
• Coordinate with ISSMs and risk management personnel.
• Assist in preparing risk recommendations for Government review.

• Coordinate with system owners regarding cybersecurity requirements.
• Support engineering and architecture reviews.
• Support implementation of new technologies.
• Facilitate communication between technical and cybersecurity stakeholders.

• Information Systems Security Managers (ISSMs)
• Security Control Assessors (SCAs)
• Security Risk Management Engineers
• Cybersecurity Engineers System Owners
• Program Managers
• System Administrators
• Enterprise Architects
• Authorizing Officials and their representatives

• Must have at least two (2) years of recent experience in A&A, FISMA compliance, IC cybersecurity policy and standards, continuous monitoring, CDS, and secure cloud and hybrid engineering, with a total of at least 10 years of related experience.
• Experience in emerging and evolving security risk management practices, including automating A&A and continuous monitoring activities.
• Experience applying NIST 800 series and CNSSI 1253 security controls and risk management framework principles and guidance (mandatory).

• CISM + CAP or GRC.

• TS/SCI with CI…