Xacta SaaS Information System Owner (ISO)

Telos•Ashburn, VA

8d•Onsite

About The Position

Telos Corporation is seeking an experienced Information System Owner (ISO) to provide security, risk, compliance, and authorization leadership for the Xacta SaaS FedRAMP-authorized Cloud Service Offering (CSO). The ISO is the accountable operational owner for maintaining system availability, security, and authorization posture, ensuring the production environment remains aligned with applicable FedRAMP and NIST requirements. The role combines cybersecurity expertise, cloud and DevSecOps knowledge, risk-management judgment, and coordination across engineering, operations, security, compliance, product, and executive stakeholders. The ISO translates regulatory requirements into practical operational controls and identifies opportunities to automate compliance and reduce the effort and cost of maintaining authorization. The position is based in Ashburn, Virginia. The salary range is $120,000–$130,000. Telos describes its compensation package as including paid time off, medical, dental, vision, tuition reimbursement, and a 401(k).

Requirements

U.S. citizenship and eligibility to access sensitive information.
Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related discipline, or an equivalent combination of education and relevant professional experience.
One or more relevant professional certifications, such as CISSP, CISM, CCSP, CGRC, or comparable cybersecurity credentials.
Approximately 5–7 years or more of progressive experience in cybersecurity, information assurance, cloud security, security operations, or related disciplines.
Demonstrated experience supporting FedRAMP, the NIST Risk Management Framework (RMF), FISMA, or comparable federal security authorization environments.
Experience with System Security Plans, Plans of Action and Milestones (POA&Ms), continuous monitoring, vulnerability management, security control assessments, control evidence collection, and risk-management activities.
Experience with Xacta or other GRC platforms.
Experience operating or securing enterprise cloud or SaaS environments.
Working knowledge of cloud security concepts, including identity and access management, network security, encryption, logging and monitoring, vulnerability scanning, configuration management, and incident response.
Ability to interpret technical vulnerability, configuration, and security data and translate findings into remediation priorities and risk decisions.
Experience coordinating security activities across engineering, operations, cybersecurity, and compliance teams.
Experience supporting security assessments, audits, or independent third-party assessments.
Strong analytical, written, verbal, and executive communication skills.
Ability to communicate technical and regulatory issues effectively to technical and non-technical stakeholders.

Nice To Haves

Direct experience supporting or maintaining a FedRAMP CSO environment.
AWS certification or a related cloud security certification.
Working knowledge and use of artificial intelligence tools, prompt engineering, and agentic workflows.
Experience interacting directly with 3PAOs, government assessors, or authorizing organizations.
Experience with DevSecOps environments, CI/CD pipelines, containers, Kubernetes, infrastructure as code, and automated security tooling.
Experience with API security, automated evidence collection, and continuous control monitoring.
Familiarity with FedRAMP 20x and machine-readable security and compliance standards such as OSCAL.
Experience integrating security telemetry from vulnerability scanners, cloud platforms, SIEM systems, CI/CD pipelines, and related security tools.
Experience supporting federal government customers or regulated cloud environments.

Responsibilities

Serve as the primary operational owner for the Xacta SaaS CSO's FedRAMP certification, operational posture, hosted-customer success, and authority to operate.
Maintain alignment among the production environment, authorization boundary, System Security Plan (SSP), security controls, architecture documentation, inventories, policies, procedures, and supporting evidence.
Coordinate FedRAMP continuous-monitoring activities and required recurring deliverables.
Oversee availability, vulnerability management, remediation tracking, POA&M activities, deviations, exceptions, and risk-acceptance processes.
Evaluate infrastructure, application, architecture, and configuration changes for security, compliance, and authorization impact.
Coordinate control owners and technical teams to ensure NIST SP 800-53 security requirements are appropriately implemented and evidenced.
Partner with DevSecOps and engineering teams on secure cloud architecture, CI/CD processes, configuration management, IAM, logging, encryption, vulnerability management, and related security capabilities.
Coordinate responses to 3PAO assessments, annual assessments, penetration testing, government reviews, customer inquiries, deliverables, and evidence requests.
Evaluate findings and security issues based on technical severity, operational impact, regulatory requirements, and overall system risk.
Escalate significant risks, compliance deficiencies, and authorization concerns to appropriate technical and executive stakeholders.
Support incident response, contingency planning, system recovery, and related FedRAMP operational security requirements.
Identify opportunities to automate security and compliance activities, including control evidence collection, asset reconciliation, vulnerability workflows, compliance, service-level telemetry, and recurring reporting.
Develop security and risk metrics that give leadership visibility into the CSO's operational and customer authorization posture.
Promote continuous improvement of security, compliance, and DevSecOps processes.