Senior Information System Security Officer

Peraton•Annapolis Junction, MD

3d•$135,000 - $216,000•Onsite

About The Position

Peraton is seeking a Senior ISSO to support our customer onsite in Annapolis Junction, MD. This role involves leading or co-leading Authorization to Operate (ATO)/reauthorization efforts for complex boundary systems, mentoring junior ISSOs, performing risk analysis, and driving security engineering outcomes. The Senior ISSO will partner with internal teams on scalable compliance patterns, brief stakeholders on security posture, and act as the primary ISSO supporting the system security lifecycle across development, operations, and modernization. Key activities include executing and maintaining Risk Management Framework (RMF) activities, operating continuous monitoring, reviewing security-relevant changes, supporting incident response, and ensuring least privilege/access governance. The role also involves translating security requirements into operational guidance for engineering teams.

Requirements

Requires active Top Secret clearance with SCI eligibility
Min 12 years with BS/BA, Min 10 years with MS/MA; may consider 4 additional years experience in lieu of BS degree.
8+ years of experience in information security/compliance supporting DOD/IC or government systems, including ownership of major RMF deliverables and ATO events for complex systems
Demonstrated leadership experience coordinating across security, engineering, and customer stakeholders
Ability to provide mentorship and direction to team members
Proven ability to write risk decisions and packages that stand up to assessor/AO scrutiny
Deep understanding of continuous monitoring at scale (recurring evidence, metrics, audit readiness, remediation governance)
Hands-on experience executing RMF tasks and maintaining authorization artifacts (SSP, POA&Ms, continuous monitoring evidence)
Strong working knowledge of NIST SP 800-53 controls and how they map to technical implementations and procedures
Experience with vulnerability and configuration compliance workflows
Ability to communicate risk clearly to both technical engineers and non-technical leadership
One or more active/current certifications such as: CISSP, CISM, SecurityX, Security+, and etc.

Nice To Haves

Experience with SAP assessments and authorizations
Experience securing or assessing different platforms (applications, databases, operating systems, hardware, and etc )
Experience with SCRUM methodologies
Experience with Splunk and/or other auditing compliance tools.
Experience with ACAS, Nessus, and/or other vulnerability scanners
Experience with data protection requirements relevant to sensitive environments

Responsibilities

Lead or co-lead ATO/reauthorization efforts for complex boundary systems
Mentor junior ISSOs and shape security operations playbooks
Perform risk analysis and author formal recommendations to leadership
Drive security engineering outcomes by partnering with internal teams on scalable compliance patterns
Brief senior internal and customer stakeholders on security posture, systemic risk trends, remediation burn-down, and authorization readiness
Act as the Senior ISSO supporting the system security lifecycle across development, operations, and modernization
Execute and maintain RMF activities (e.g., control implementation oversight, evidence collection, assessment support, POA&M management, continuous monitoring)
Maintain security authorization artifacts (e.g., SSP, control narratives, diagrams, inheritance/leverage controls, CM plan, incident handling plan, contingency artifacts, user/admin procedures)
Operate continuous monitoring: vulnerability management, config compliance, patching coordination, scan result triage, risk acceptance, and remediation verification
Review and approve security-relevant changes through configuration/change control and validate security configurations after major upgrades
Support incident response and reporting: participate in investigations, coordinate containment actions, preserve evidence, and contribute to post-incident lessons learned
Ensure least privilege/access governance: account management oversight, privileged access workflows, periodic access reviews, and audit compliance requirements
Translate security requirements into implementation guidance that engineering teams can operationalize (clear, testable, and automatable where possible)