Information System Security Officer–Federal Programs

Commence•Virginia Beach, VA

6d•$100,000 - $140,000•Remote

About The Position

The Information System Security Officer (ISSO) is the designated security officer and information assurance lead for Commence systems supporting federal programs. Reporting to the Information Systems Security Manager (ISSM), the ISSO manages day-to-day security assessment, authorization, and continuous-monitoring activities to keep assigned systems authorized to operate for federal agencies Commence supports as a prime contractor or subcontractor. System assignments are set by the ISSM and may be shared across multiple ISSOs. The ISSO works with the CIO, Cybersecurity Engineers, Compliance Analysts, Project Managers, and teams across Operations, Engineering, Contracts, and Human Resources. The position serves as a system-level security liaison to federal agencies and partner organizations, coordinates authorization work and security requirements with project teams, and supports federal contract deliverables and personnel-security tasks. The role also supports internal audits and control assessments across applicable security and privacy frameworks. This is a remote position with an estimated 15–25% travel. Commence is headquartered in Virginia Beach, Virginia, and accepts remote candidates in the states listed in the posting. The work is generally performed in a climate-controlled environment and requires extended periods of sitting, reading, computer use, and viewing a computer screen. Occasional standing, walking, and use of hands and fingers, kneeling, or crouching may be required. On-call coverage for security incidents is expected.

Requirements

At least 5 years of information assurance or cybersecurity experience, including at least 3 years as an ISSO or A&A lead for federal information systems.
Bachelor’s degree in a related field or equivalent experience.
Personal experience taking at least one federal system through an initial ATO or reauthorization under NIST SP 800-37/800-53, including SSP authorship and POA&M management in agency-specific GRC platforms.
Working knowledge of at least two of the following: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publications 1075 and 4812, or DHS 4300A.
Ability to read vulnerability and configuration scan output, including Tenable/Nessus, Defender, AWS Inspector, or SCAP/STIG Viewer, and translate findings into remediation tasks.
Familiarity with AWS and Microsoft 365/Azure.
Clear, precise writing skills and ability to manage several systems and deadline schedules at once.
CompTIA Security+ or a higher DoD 8140-qualifying certification.
U.S. citizenship and ability to obtain and maintain federal Public Trust suitability.
Ability to sit, read, work on a computer, and watch a computer screen for extended periods; occasional standing, walking, use of hands and fingers, kneeling, or crouching may be required.

Nice To Haves

Experience with FedRAMP and HIPAA.
CISSP, CGRC (formerly CAP), CISA, or CCSP certification.

Responsibilities

Serve as the designated ISSO for assigned federal systems and the primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams.
Carry out priorities set by the CIO and ISSM, and escalate program-level issues, risk acceptances, and exceptions to the ISSM with a recommended path.
Partner with Project Managers to incorporate security and authorization milestones into project plans, assess security impacts of system changes before release, and keep federal deliverable dates visible to project and program teams.
Run the Security Assessment and Authorization lifecycle under the NIST Risk Management Framework (SP 800-37), from FIPS 199 categorization through authorization, ongoing authorization, and reauthorization.
Author and maintain the System Security and Privacy Plan, risk assessment, Privacy Impact Assessment, contingency plan and annual test, incident response plan, configuration management plan, and interconnection agreements for ISSM review.
Maintain POA&Ms in agency GRC platforms; review monthly vulnerability and configuration scans against DISA STIGs, CIS benchmarks, and agency baselines; coordinate and track remediation with Cybersecurity Engineers and IT Operations; and prepare ongoing-authorization and continuous-monitoring reports.
Lead system-level preparation for CMS Security Controls Assessments and Adaptive Capabilities Testing, VA and DoD assessments, and IRS Safeguards reviews; coordinate evidence collection and findings responses with Compliance Analysts.
Maintain compliance with applicable agency requirements, including CMS ARS and IS2P2; VA Handbook 6500 and 6500.6; DFARS 252.204-7012, NIST SP 800-171, and CMMC 2.0 for DoD/DHA; IRS Publications 1075 and 4812; DHS 4300A and Sensitive Security Information handling; and CUI, FISMA, HIPAA, and the Privacy Act.
Act as first responder for security and privacy incidents affecting federal data on assigned systems; escalate incidents immediately to the ISSM and CIO and meet agency notification timelines in coordination with the Privacy Officer and prime contractors.
Complete system-level contract security deliverables and manage federal personnel-security tasks, including Public Trust and e-QIP processing, agency training, rules of behavior, and access attestations.
Support the CIO and ISSM with internal audits and control assessments against SOC 2, NIST CSF, NIST SP 800-53, NIST SP 800-171, HIPAA, HITRUST, and ISO/IEC 27001, including control testing, evidence preparation, gap analysis, and corrective-action tracking.
Provide system-specific input to the ISSM and Compliance Analyst, who own external audits and customer and prime contractor security questionnaires.
Participate in on-call coverage for security incidents.