Principal Information System Security Officer

Clarity Innovations•Columbia, MD

10d•$102,200 - $173,700•Hybrid

About The Position

Clarity Innovations is hiring a Principal Information System Security Officer (ISSO) to support the ISSM and own authorization documentation for a platform at the unclassified CUI level across all development teams. This is the single ISSO seat for that platform and classification combination; other environments have separate ISSOs. The role is not embedded with one team and instead consolidates multiple teams’ needs into one authorization package. Initial responsibilities are limited to the CUI system, with longer-term surge and backfill support for other environments as clearance and access allow. The position focuses on establishing and maintaining ATO packages and associated artifacts, maintaining interconnection agreements, and transitioning the package from NIST SP 800-53 Rev 4 to Rev 5. The ISSO maintains accurate documentation as the system changes and may improve documentation and reporting through automation where practical. eMASS is the system of record for the body of evidence and POA&Ms. The role works with security engineers, development teams, SCAs, AO staff, and government counterparts. Contractor ISSOs and ISSMs do not accept new risk; they assess whether proposals align with the current risk posture and refer matters outside it to the appropriate government authority. The position is hybrid, with an expected three to four days onsite, although customer needs may result in weeks with more or no onsite work. A counterintelligence polygraph is required upon hiring if not already attained.

Requirements

Be a U.S. citizen able to obtain and maintain a TS/SCI clearance with CI polygraph.
Hold a current DoD 8570.01-M IAM Level II or III certification.
Have at least 5 years of relevant experience developing and maintaining RMF authorization packages.
Have working knowledge of RMF, NIST SP 800-37, NIST SP 800-53 Rev 4 and Rev 5, NIST SP 800-53B, NIST SP 800-60, and DoDI 8510.01.
Have experience maintaining the body of evidence, control statements, and POA&Ms in eMASS.
Have experience writing or maintaining ISAs or other interconnection agreements, including familiarity with NIST SP 800-47 Rev 1.
Understand network flows and architecture, especially in Azure, AWS, on-premises, and hybrid environments.
Be able to switch context across teams with differing priorities and consolidate their work into one coherent authorization package for the platform.
Be familiar with auditing and control assessments, including working with SCAs.
Be familiar with the SDLC and working across multiple Agile or DevSecOps development teams.
Know government security requirements for unclassified and CUI systems.
Have strong written and verbal communication skills and be able to produce clear, accurate technical documentation independently.
Be able to work independently with engineering and government stakeholders.
Hold a bachelor’s degree in Computer Science, Cybersecurity, or a related technical discipline; no experience equivalency applies.

Nice To Haves

Have 7 or more years of relevant experience developing and maintaining RMF authorization packages.
Hold an active TS/SCI clearance with CI polygraph.
Have experience migrating an authorization package from NIST SP 800-53 Rev 4 to Rev 5.
Have experience taking a package from creation to full ATO.
Have experience with classified system authorization, such as CNSSI 1253 overlays.
Have experience reading and interpreting vulnerability scan results to support CVE validation and POA&M entries.
Have experience mentoring junior teammates.

Responsibilities

Own and maintain the authorization package and body of evidence, including the SSP, control statement responses, and supporting artifacts, so documentation reflects the current system state.
Transition the authorization package from NIST SP 800-53 Rev 4 to Rev 5 in coordination with the ISSM, using compliance evidence from security engineers and development teams.
Develop and maintain interconnection and boundary documentation, including ISAs and related agreements.
Own POA&M entries and milestone tracking, coordinating remediation artifacts and status with security engineers and development teams.
Prepare ConMon documentation and reporting on schedule and ensure findings are accurately captured in the package.
Maintain the SBOM and component version representation in the package, validate components against CVE data and mitigation guidance, and communicate required vulnerability remediation to owning teams.
Participate in architectural planning and obtaining AO and government customer buy-in when a compensating control is proposed.
Participate in the CCB, document the authorization impact of proposed changes, and keep the package aligned with approved changes.
Fill in for the project ISSM on the unclassified system when the ISSM is unavailable, without accepting new risk.
Coordinate with security engineers, development teams, SCAs, AO staff, and government counterparts on technical evidence, artifacts, documentation requests, and findings.
Draft risk acceptance and deviation documentation when assigned by the ISSM, for ISSM review before submission.
Identify project-specific security training and awareness gaps not covered by customer or company guidance, in coordination with the ISSM.
Support security authorization activities in compliance with RMF, DoDI 8510.01, and related DoD processes.
Provide surge support and backfill for ISSOs of other environments, including leave coverage, as clearance and access allow.