Senior Information System Security Officer

Sharp Solutions Inc•Washington, DC

2d•$120,000 - $125,000

About The Position

The Senior Information System Security Officer (ISSO) / POA&M Remediation and Compliance Specialist provides senior-level cybersecurity, risk management, and compliance support for the Acquisition Systems Branch's PRM2 solution. The role works with the PRM2 ISSO, system owners, technical teams, and Government stakeholders to support compliance with Department of Homeland Security cybersecurity requirements. The position supports security assessments, authorization activities, security documentation, vulnerability remediation, and POA&M management. It helps plan and maintain the documentation and evidence needed to achieve and sustain an Interim Authority to Operate (IATO) and Authority to Operate (ATO), and translates identified security weaknesses into documented, trackable, and verifiable remediation actions. The role also coordinates vulnerability scanning and patching, reviews proposed configuration changes for security impacts, supports audits and assessments, maintains audit-ready evidence, and reports cybersecurity status and risks to program and Government stakeholders. Performance milestones include supporting an IATO within six months of contract award when required and an ATO within 12 months of contract award.

Requirements

Bachelor's degree in cybersecurity, information technology, computer science, information systems, engineering, or a related discipline.
Senior-level experience supporting federal information system security, cybersecurity compliance, or security authorization activities.
Demonstrated experience supporting ATO and, when applicable, IATO preparation and maintenance.
Experience managing POA&M development, remediation tracking, evidence validation, milestone updates, and closure activities.
Experience reviewing and coordinating vulnerability scans, patching, remediation, and verification activities.
Experience developing and maintaining cybersecurity plans, assessment documentation, and authorization evidence.
Knowledge of federal risk management and information security principles.
Ability to interpret cybersecurity requirements and translate them into actionable technical, programmatic, and documentation tasks.
Experience supporting security assessments, audits, compliance reviews, and authorization activities.
Strong written communication, documentation, coordination, and stakeholder-management skills.
Ability to communicate effectively with Government ISSOs, system owners, assessors, program managers, developers, engineers, administrators, and executive stakeholders.

Nice To Haves

Experience supporting DHS information systems and cybersecurity requirements.
Working knowledge of DHS MD 4300A.
Experience supporting acquisition, procurement, or mission-business systems.
Experience with application, operating system, and database security.
Experience performing security impact analyses for hardware, software, configuration, and boundary changes.
Experience maintaining security documentation and supporting evidence in an audit-ready environment.
Relevant cybersecurity certification such as CISSP, CISM, CISA, CAP/CGRC, CASP+, or Security+.

Responsibilities

Provide cybersecurity and compliance support to the PRM2 ISSO, system owner, and Government stakeholders.
Support PRM2 compliance with DHS information technology security requirements and monitor changes that may affect the system's security authorization or compliance posture.
Provide documentation, analysis, and technical support for security assessments, audits, authorization activities, and recurring compliance reviews.
Coordinate with application, database, infrastructure, operations, and security personnel to address cybersecurity requirements.
Support planning, preparation, coordination, and maintenance of documentation and evidence for IATO and ATO activities.
Track authorization milestones, compliance actions, responsible parties, dependencies, and completion dates, and help resolve deficiencies that could delay authorization.
Develop, review, maintain, and track POA&M entries for findings from assessments, vulnerability scans, audits, penetration tests, and configuration reviews.
Coordinate corrective action plans, monitor remediation progress, facilitate POA&M reviews, validate remediation evidence, and support documented POA&M updates or closure.
Maintain traceability among findings, POA&M actions, remediation evidence, scan results, and security requirements; escalate material risks and missed milestones.
Develop and maintain the IT Security Plan and other security documentation, ensuring it reflects the current system environment, architecture, boundaries, technologies, interfaces, and safeguards.
Coordinate document reviews, revisions, approvals, and version control, and identify and address documentation gaps.
Coordinate vulnerability scans, review scan results, and work with technical teams to prioritize and carry out remediation and patching.
Track vulnerabilities through remediation, verification, and closure; validate remediation through rescans, technical evidence, or other approved methods.
Communicate patch status, dependencies, exceptions, and residual risks to Government stakeholders, including updates to the PRM2 ISSO concerning relevant patches affecting the authorization boundary.
Notify and update the PRM2 ISSO regarding hardware and software configuration changes affecting the authorization boundary.
Review proposed configuration changes and support security impact analyses; ensure approved changes are reflected in security plans, diagrams, inventories, procedures, and authorization documentation.
Support internal and external security assessments, compliance and authorization reviews, and cybersecurity audits; coordinate requested evidence and help stakeholders prepare for interviews and control reviews.
Maintain an audit-ready repository and track assessment findings through resolution and documented closure.
Prepare recurring cybersecurity status reports covering authorization activities, POA&Ms, vulnerabilities, patches, findings, configuration changes, and compliance risks.
Communicate cybersecurity issues in business and mission terms and recommend risk treatment, remediation priorities, and escalation paths.