RMF Information System Security Officer (ISSO)

COLSA•Albany, GA

About The Position

COLSA is seeking an experienced RMF Information System Security Officer to support cybersecurity and Risk Management Framework activities. The role provides expertise throughout the RMF authorization process, including developing and maintaining RMF Assessment and Authorization (A&A) packages, guiding information owners through RMF requirements, supporting security control assessments, and managing vulnerability and remediation activities. The ISSO works with ISSMs, Government RMF ISSOs, information owners, validators, and other stakeholders to support system authorization and maintain the security posture of assigned information systems. The position is contingent upon contract award, with work anticipated to begin in November 2027. The selected candidate will be proposed as Key Personnel in accordance with proposal requirements.

Responsibilities

Complete authorization and assessment packages within 120 days of system ATO expiration.
Keep stakeholders informed of risk, status, and roles and responsibilities throughout the RMF process.
Guide information owners through Step 0, System Registration, in the Compliance and Authorization Support Tool.
Guide information owners through Step 1, System Categorization, based on information provided by the information owner.
Guide information owners through Step 2, security control selection, including determining the appropriate defense level and overlays.
Provide information owners with an export of selected security controls and applied overlays to populate Implementation Details.
Review completed security control implementation details and obtain validator approval.
Guide information owners in developing a System Security Plan (SSP) that addresses assessment objectives, methods for verifying control compliance, the initial control assessment schedule, and assessment procedures.
Work with the ISSM and lead Government RMF ISSO to conduct the initial assessment of security control effectiveness and document issues, findings, and recommendations in a Security Assessment Report (SAR).
Develop a project plan and Plan of Action and Milestones (POA&M) addressing unremediated vulnerabilities, failed Security Technical Implementation Guideline (STIG) checks, and failed security controls.
Manage and update the POA&M at least monthly throughout the information system lifecycle, using the latest vulnerability scans and STIG checklists.
Monitor networks and supporting systems to detect security compromise events, including intrusions and virus incidents.
Identify deviations from acceptable system or network configurations, enclave policy, or local policy.
Conduct audits to ensure information systems security policies and procedures are implemented as defined in security plans and best practices.
Perform compliance audits and/or active evaluations such as vulnerability assessments.
Lead response teams to ensure anomalies are corrected in accordance with government or industry standards.