Principal Information System Security Officer

Clarity Innovations•Columbia, MD

8d•Hybrid

About The Position

The Principal Information System Security Officer (ISSO) supports the ISSM and owns the authorization documentation for the platform’s unclassified (CUI) environment across all development teams. This is the sole ISSO position for that platform and classification combination; separate ISSOs cover other environments. The ISSO consolidates the teams’ work into a single authorization package and keeps the package accurate as the system changes. The role initially focuses on the unclassified CUI system and, as clearance and access allow, may provide surge support and backfill for ISSOs in other environments, including leave coverage. The position focuses on establishing and maintaining ATO packages and associated artifacts, maintaining interconnection agreements, and transitioning the package from NIST SP 800-53 Rev 4 to Rev 5. eMASS is the system of record for the body of evidence and POA&Ms. The ISSO works with security engineers, development teams, SCAs, AO staff, and government counterparts to gather evidence, track remediation, document changes, and address findings. The role identifies vulnerabilities and required mitigations but does not select among alternative libraries or products. Contractor ISSOs and ISSMs do not accept new risk; proposals outside the current risk posture are referred to the appropriate government authority. The role requires moving between teams with differing goals and priorities, independently producing clear and accurate technical documentation, and improving documentation and reporting through automation where practical. This is a hybrid position with an expected three to four days onsite, though customer needs may result in weeks with more or no onsite work. A counterintelligence polygraph is required upon hiring if not already attained.

Requirements

U.S. citizenship and ability to obtain and maintain a TS/SCI clearance with CI polygraph.
Current DoD 8570.01-M IAM Level II or III certification.
At least 5 years of relevant experience developing and maintaining RMF authorization packages.
Working knowledge of RMF, NIST SP 800-37, NIST SP 800-53 Rev 4 and Rev 5, NIST SP 800-53B, NIST SP 800-60, and DoDI 8510.01.
Experience maintaining the body of evidence, control statements, and POA&Ms in eMASS.
Experience writing or maintaining ISAs or other interconnection agreements, including familiarity with NIST SP 800-47 Rev 1.
Understanding of network flows and architecture, especially cloud environments (Azure and AWS), on-premises environments, and hybrid environments.
Ability to context switch across multiple teams with differing goals and priorities and consolidate their work into one coherent authorization package for the platform.
Familiarity with auditing and control assessments, including working with SCAs.
Familiarity with the SDLC and working across multiple Agile or DevSecOps development teams.
Knowledge of government security requirements for unclassified and CUI systems.
Strong written and verbal communication skills, including the ability to produce clear, accurate technical documentation independently with limited AI/LLM support.
Ability to work independently with engineering and government stakeholders.
Bachelor’s degree in Computer Science, Cybersecurity, or a related technical discipline; no experience equivalency applies.

Nice To Haves

7 or more years of relevant experience developing and maintaining RMF authorization packages.
Active TS/SCI clearance with CI polygraph.
Experience migrating an authorization package from NIST SP 800-53 Rev 4 to Rev 5.
Experience taking an authorization package from creation to full ATO.
Experience with classified system authorization, such as CNSSI 1253 overlays.
Experience reading and interpreting vulnerability scan results to support CVE validation and POA&M entries.

Responsibilities

Own and maintain the authorization package and body of evidence, including the SSP, control statement responses, and supporting artifacts, so documentation reflects the current system state.
Maintain the BoE and POA&Ms in eMASS, the system of record for this role.
Coordinate and execute the package transition from NIST SP 800-53 Rev 4 to Rev 5 with the ISSM, using compliance evidence from security engineers and development teams.
Develop and maintain interconnection and boundary documentation, including ISAs and related agreements.
Own POA&M entries and milestone tracking, coordinating remediation artifacts and status with security engineers and development teams.
Prepare scheduled continuous monitoring (ConMon) documentation and reporting, ensuring findings are accurately captured in the package.
Maintain the SBOM and component-version representation in the package; validate components against CVE data and mitigation guidance; identify required remediation and communicate it to owning teams.
Participate in architectural planning and obtaining AO and government customer buy-in when a compensating control is proposed.
Participate in the CCB, document the authorization impact of proposed changes, and keep the package aligned with approved changes.
Fill in for the project ISSM on the unclassified system when the ISSM is unavailable.
Coordinate with security engineers, platform development teams, SCAs, AO staff, and government counterparts on technical evidence, artifacts, documentation requests, and findings.
Draft risk acceptance and deviation documentation when assigned by the ISSM, for ISSM review before submission.
Identify project-specific security training and awareness gaps not covered by customer or company guidance, in coordination with the ISSM.
Support security authorization activities in compliance with RMF, DoDI 8510.01, and related DoD processes.
As clearance and access allow, provide surge support and backfill for ISSOs in other environments, including leave coverage.