Senior Information System Security Officer

Sharp Solutions•Washington, DC

About The Position

The Senior Information System Security Officer (ISSO) / POA&M Remediation and Compliance Specialist provides senior-level cybersecurity, risk management, and compliance support for the Acquisition Systems Branch's PRM2 solution. The role works with the PRM2 ISSO, system owners, technical teams, and Government stakeholders to support compliance with Department of Homeland Security (DHS) cybersecurity requirements and timely achievement and maintenance of an Interim Authority to Operate (IATO) and Authority to Operate (ATO). The position supports security assessments and audits, maintains security plans and authorization documentation, coordinates vulnerability remediation and patching, and manages Plans of Action and Milestones (POA&Ms). It translates identified security weaknesses into documented, trackable, and verifiable corrective actions; monitors authorization milestones and remediation progress; and communicates security risks, status, and recommendations to technical teams and leadership. The role also reviews proposed system changes for cybersecurity impacts, ensures documentation reflects the current system environment, and maintains organized, audit-ready security evidence. Performance milestones include supporting an IATO within six months of contract award when required and supporting an ATO within 12 months of contract award, while maintaining applicable security compliance.

Requirements

Bachelor's degree in cybersecurity, information technology, computer science, information systems, engineering, or a related discipline.
Senior-level experience supporting federal information system security, cybersecurity compliance, or security authorization activities.
Demonstrated experience supporting ATO and, when applicable, IATO preparation and maintenance.
Experience managing POA&M development, remediation tracking, evidence validation, milestone updates, and closure activities.
Experience reviewing and coordinating vulnerability scans, patching, remediation, and verification activities.
Experience developing and maintaining cybersecurity plans, assessment documentation, and authorization evidence.
Knowledge of federal risk management and information security principles.
Ability to interpret cybersecurity requirements and translate them into actionable technical, programmatic, and documentation tasks.
Experience supporting security assessments, audits, compliance reviews, and authorization activities.
Strong written communication, documentation, coordination, and stakeholder-management skills.
Ability to communicate effectively with Government ISSOs, system owners, assessors, program managers, developers, engineers, administrators, and executive stakeholders.

Nice To Haves

Experience supporting DHS information systems and cybersecurity requirements.
Working knowledge of DHS MD 4300A.
Experience supporting acquisition, procurement, or mission-business systems.
Experience with application, operating system, and database security.
Experience performing security impact analyses for hardware, software, configuration, and boundary changes.
Experience maintaining security documentation and supporting evidence in an audit-ready environment.
Relevant cybersecurity certification such as CISSP, CISM, CISA, CAP/CGRC, CASP+, or Security+.

Responsibilities

Provide senior-level cybersecurity and compliance support to the PRM2 ISSO, system owner, and Government stakeholders.
Support PRM2 compliance with DHS information technology security requirements and security best practices throughout the system lifecycle.
Provide documentation, analysis, and technical support for security assessments, audits, authorization activities, and recurring compliance reviews.
Coordinate cybersecurity requirements and remediation with application, database, infrastructure, operations, and security personnel.
Monitor changes to the PRM2 environment and assess their potential effects on security authorization and compliance.
Plan, prepare, coordinate, and maintain security documentation for ATO and, when required, IATO activities in accordance with DHS MD 4300A and applicable requirements.
Collect, review, and organize authorization evidence; track milestones, actions, owners, dependencies, and completion dates; and help resolve deficiencies that could delay authorization.
Develop, review, maintain, and track POA&M entries; ensure findings, corrective actions, owners, resources, milestones, and target dates are documented.
Coordinate corrective action plans, monitor remediation progress, facilitate POA&M reviews, review closure evidence, and support POA&M updates or closure requests.
Maintain traceability among assessment findings, POA&M actions, remediation evidence, vulnerability scan results, and security requirements; escalate material risks and overdue or blocked actions.
Develop and maintain the IT Security Plan and other security documentation, ensuring they reflect the current system environment, architecture, boundaries, technologies, interfaces, and safeguards.
Coordinate document reviews, revisions, approvals, and version control; identify documentation gaps; and maintain organized, audit-ready evidence.
Coordinate vulnerability scans, review results, and work with technical teams to prioritize and execute remediation and patching across system components.
Track vulnerabilities through remediation, verification, and closure; validate corrective actions through rescanning, technical evidence, or other approved methods; and document vulnerabilities that cannot be remediated on time.
Provide the PRM2 ISSO with updates on patches affecting PRM2 and its authorization boundary, excluding the DEC AWS environment where specified.
Review proposed hardware and software configuration changes for cybersecurity and compliance impacts; support security impact analyses and ensure approved changes are reflected in security documentation.
Coordinate with change-management and technical teams to ensure security requirements are addressed before changes are implemented and monitor changes that could affect vulnerabilities, safeguards, or authorization status.
Support security assessments, compliance and authorization reviews, and audits by coordinating evidence, preparing stakeholders, analyzing findings, and tracking corrective actions through closure.
Maintain an audit-ready repository of security documentation, scan results, remediation evidence, configuration information, and approval records.
Prepare recurring cybersecurity status reports covering authorization activities, POA&Ms, vulnerabilities, patches, findings, configuration changes, and compliance risks.
Explain cybersecurity issues in business and mission terms and recommend risk treatments, remediation priorities, and escalation paths.
Support IATO achievement within six months of contract award when required and ATO achievement within 12 months of contract award, while maintaining applicable compliance.