Principal Information System Security Officer (ISSO)

ZipStaff • Washington, DC

3d • Onsite

About The Position

ZipStaff is hiring a Principal Information System Security Officer (ISSO) for a major U.S. passenger rail transportation organization based in Washington, DC. This is an onsite, 11-month W2 contract role. The ISSO will serve as an embedded cybersecurity subject matter expert and risk advisor, championing secure-by-design principles across enterprise Agile Release Trains and ensuring that security controls and compliance are incorporated into architecture and delivery from the start.

Requirements

• At least 10 years of cybersecurity experience, including at least 5 years as an ISSO, in Information Assurance or Security Architecture in enterprise or government-adjacent environments.
• Experience embedding security governance in Agile, Scrum, or SAFe environments and modern CI/CD pipelines.
• Deep knowledge of the NIST SP 800 series, including NIST SP 800-37 RMF, NIST SP 800-53, and NIST SP 800-160; FISMA; FedRAMP; ISO 27001; and CIS Benchmarks.
• Experience evaluating cloud platforms (AWS, Azure, or GCP), containerized platforms, APIs, and hybrid infrastructure for risk.
• Ability to translate security requirements into actionable technical guidance and communicate risk to leadership.
• Active CISSP, CISM, CRISC, CCSP, or CISA certification.
• Based in the greater Washington, DC area.
• Able to obtain or maintain a public trust or clearance as required.

Responsibilities

• Provide cybersecurity design oversight, threat modeling, and risk governance across Agile Release Trains and delivery pipelines.
• Embed security architectures and baseline controls early in the SDLC to reduce technical debt and deployment risk.
• Serve as the primary cybersecurity liaison among product managers, enterprise architects, engineering teams, and senior stakeholders.
• Author and evaluate SSPs, RARs, SAPs, and POA&Ms.
• Ensure compliance with NIST SP 800-37, NIST SP 800-53, FISMA, FedRAMP, and internal governance directives.
• Partner with engineering leads to operationalize DevSecOps, automate continuous monitoring, and enforce secure coding and configuration standards.
• Facilitate risk-based trade-off decisions, review architecture deviations, and lead remediation of complex vulnerabilities.

Benefits

• Health insurance
• Dental insurance
• Vision insurance
• 401(k)
• 401(k) matching
• Paid time off
• Referral program

What This Job Offers

• Career Level: Principal
• Education Level: No Education Listed