Information System Security Officer (ISSO)

CGI•Fairfax, VA

About The Position

CGI Federal is building the next generation of the Department of Veterans Affairs’ Medical Disability Examination program, with the goal of modernizing exam scheduling, performance, and delivery through automation, secure data integration, and human-centered design. The Information System Security Officer (ISSO) serves as the dedicated security lead for the Contractor’s system under the MDE contract and manages the activities needed to achieve and maintain an Authority to Operate (ATO) with the VA. The role oversees security controls, regulatory compliance, risk management, and protection of sensitive Veteran data. The ISSO coordinates ATO-related tasks, tracks progress, and serves as the primary contact for VA IT, security, and privacy teams. The ISSO leads ATO management and coordination, oversees implementation and maintenance of VA-required security controls, and coordinates vulnerability management, incident reporting, risk assessments, compliance activities, security scans, assessments, and remediation. The role works with VA stakeholders and the Contractor’s internal IT teams, maintains security evidence and documentation, supports VA systems and tools, and leads incident response and continuous improvement of the system’s security posture. The position requires a bachelor’s or advanced degree and at least eight years of relevant experience.

Requirements

Bachelor’s or advanced degree in information security, IT, cybersecurity, or a related field.
At least 8 years of experience in information security management, IT regulatory compliance, or equivalent federal security roles.
Demonstrated experience with federal ATO processes; VA experience is preferred.
Strong understanding of NIST 800-53, FISMA requirements, and federal risk management frameworks.
Experience with GRC tools such as eMASS and coordination with federal cybersecurity organizations.
Ability to obtain and maintain a VA PIV badge.

Nice To Haves

Experience supporting VA programs, systems, or data environments.
Strong communication, documentation, and stakeholder coordination skills.
Analytical expertise in risk identification, mitigation, and compliance reporting.

Responsibilities

Lead and coordinate all elements of the VA ATO process to obtain and maintain an ATO for the Contractor’s systems.
Maintain ATO schedules and milestones, identify delays, report risks, and update baseline timelines as needed.
Manage documentation, evidence collection, and review processes for ATO readiness.
Serve as the primary liaison with VA security stakeholders and provide accurate, transparent security information.
Ensure VA-required IT security controls are implemented, monitored, and maintained in alignment with applicable policies, standards, and frameworks.
Coordinate vulnerability management, incident reporting, risk assessments, and compliance activities.
Protect claimant personal, health, and benefits-related data across Contractor interfaces with VA systems.
Maintain a PIV badge and VA email account for ISSO responsibilities within VA systems and applications.
Designate and mentor a backup Security Point of Contact with PIV credentials to provide security coverage during absences.
Act as the principal contact for VA ISOs, System Stewards, CORs, Privacy Officers, and ISSOs on security and ATO matters.
Collaborate with Contractor internal IT teams to meet VA security and compliance requirements.
Coordinate access to VA security-related tools and platforms.
Ensure information security evidence is complete, accurate, and less than one year old.
Respond accurately and promptly to VA security and privacy data calls.
Review security questionnaires regularly to ensure they reflect current system status and control requirements.
Review GRC systems such as eMASS when system changes occur and execute plans to update ATO documentation.
Coordinate required security scans with the VA Cyber Security Operations Center.
Support VA Security Control Assessments and remediation activities.
Lead Contractor response to and management of information security incidents related to VA systems or data.
Notify VA stakeholders of potential security or privacy incidents and communicate status updates.
Maintain Contractor database integrity, access controls, and data protection measures in accordance with applicable PWS sections.
Monitor compliance with federal, VA, and contract-specific cybersecurity requirements.
Lead continuous improvement efforts to strengthen the system security posture.