ISSO Lead DoS CSS

OneZero Solutions•Washington, DC

1d•Remote

About The Position

The ISSO Lead is the senior technical authority for the program and the Government's central ISSO point of contact for the DT/EA/CST portfolio. The ISSO Lead maintains an accurate, current picture of every consular system's lifecycle stage, authorization status, and risk posture; leads a team of SME, Senior, and Information Assurance analysts serving as ISSOs of record; sets technical direction for the vulnerability management and cloud engineers; and interfaces daily with the Information Systems Security Manager (ISSM), Authorizing Official's Designated Representative (AODR), and system owners. This is a designated Key Personnel position.

Requirements

Eight (8)+ years of experience as an ISSO or in a similar Assessment & Authorization role (RFQ §M, Factor 2).
Experience supporting 50 or more FISMA information systems.
Demonstrated expertise with the NIST Risk Management Framework and FISMA compliance (NIST SP 800-37 Rev. 2, SP 800-53 Rev. 5, SP 800-60, FIPS 199/200).
Current CISSP or CISM certification.
Active, final SECRET security clearance; U.S. citizenship.
Experience leading and quality-reviewing the work of other ISSOs or IA analysts.
Experience using an enterprise GRC tool to manage authorization packages and POA&Ms.
Available at the time of Call Order award and committed to the full base period of performance.

Nice To Haves

Master's degree in a related field.
Department of State experience (DT, CA, or CST), including ArchAngel and iPost.
CGRC/CAP, CISA, or CRISC certification in addition to CISSP/CISM.
Experience with High Value Asset (HVA) systems, cloud/hybrid authorization boundaries, FedRAMP inheritance, and zero-trust overlays.
Experience leading teams of 10 or more cybersecurity professionals.

Responsibilities

Maintain an accurate, up-to-date portfolio of all consular systems, including system lifecycle stage, authorization status and ATO expiration, and a high-level view of risk assessment and risk management activity.
Maintain version control of RMF artifacts and prepare briefings and reports for the ISSM, AO/AODR, and CST leadership.
Assign systems to ISSO staff and balance workloads so that every current and future CA system completes the full RMF (Steps 1–6) at least every three years and maintains its ATO.
Serve as senior escalation point for categorization, control tailoring, inherited-controls, and POA&M risk-rating decisions; review Security Plan Approval Recommendation Letters and AODR Information Sheets before release(RMF Steps 2 and 5).
Provide direction and oversight to system-specific security operations contractors (database, application, and platform security operations) to obtain evidence and drive remediation, ensuring they do not independently develop authoritative RMF artifacts.
Lead quarterly FISMA metrics submissions and support the Annual FISMA Review.
Standardize and govern program-wide artifacts: Evidence Index, Inherited Controls Matrix, System Boundary & Data Flow Package, Control Tailoring Rationale, and Audit and Data Call Response Package.
Chair Implementation Readiness Reviews prior to independent Security Control Assessments and oversee SCRM/demo preparation(RMF Steps 3–4).
Oversee iPost risk-score management, ensure findings open more than 30 days are tracked and reported, and enforce BOD remediation timelines across the portfolio(RMF Step 6).
Lead post-incident reviews for significant incidents and ensure outcomes flow into risk assessments, POA&Ms, SSPs, and control implementation statements.
Mentor, coach, and quality-review the work of SME, Senior, and Information Assurance analysts; set technical priorities for the Tenable, Wiz/cloud, and DevSecOps engineers.
Identify security requirements for new systems throughout the SDLC and DevSecOps pipelines; participate in the Risk Governance process.