Senior Information Systems Security Officer (ISSO)

Quantum Sky•Washington, DC

5d•$135,000 - $150,000•Onsite

About The Position

Quantum Sky is seeking a senior Information Systems Security Officer to support a federal customer in Washington, DC. The role leads information security, privacy, and Governance, Risk, and Compliance (GRC) activities to keep federal systems secure, compliant, and mission-ready. The ISSO serves as a trusted advisor to government customers and works with technical and executive stakeholders, balancing customer needs with federal security and privacy requirements. The position supports systems throughout the Risk Management Framework (RMF) lifecycle, including Authorization to Operate (ATO) and continuous monitoring. It involves managing security and privacy initiatives from planning through delivery, preparing authorization documentation, assessing risks and vulnerabilities, and coordinating compliance, audit, privacy, and continuity activities. The role is on-site in Washington, DC, with minimal remote flexibility.

Requirements

At least 8 years of professional experience, including at least 5 years supporting ISSO RMF activities.
Bachelor’s degree, or 4 additional years of experience in lieu of a degree. A high school diploma with 8 years of experience in the functional responsibility area may be substituted for a bachelor’s degree.
Knowledge of federal government privacy programs, including the Privacy Act of 1974, the E-Government Act of 2002, and related federal privacy laws and regulations.
Understanding of information privacy principles, including information access, release of information, and privacy controls for electronic and non-electronic information.
Experience supporting Cybersecurity Awareness Training (CSAT) privacy initiatives, including training development, effectiveness evaluation, and privacy awareness programs.
Experience with HR privacy and behavioral privacy considerations related to workforce data and monitoring activities.
Thorough knowledge of FISMA, NIST RMF, Security and Privacy Assessment & Authorization (SPA&A), NIST publications, OMB circulars and memoranda, and CNSS guidance.
Strong written and verbal communication skills, including technical documentation, presenting complex security and privacy concepts to technical and non-technical audiences, and building trusted stakeholder relationships.
Ability to lead end-to-end security and compliance initiatives, manage competing priorities, drive deliverables to completion, and exercise sound judgment in a fast-paced, customer-focused environment.
Highly organized, detail-oriented, and self-motivated, with strong analytical and critical-thinking skills, commitment to audit-ready documentation, and ability to identify process improvements while balancing customer service and regulatory compliance.
US citizenship and eligibility for Public Trust are required.
PMP, ISO 27001, or CISM certifications equate to 3 years of experience in the functional responsibility area each.
ITIL, CISSP, or other relevant IT management certifications equate to 2 years of general experience each.

Nice To Haves

CRISC, CAP, CISSP, or equivalent certification.
Experience with FedRAMP and cloud service providers.
Experience with CSAM and ServiceNow.
Experience with vulnerability assessment tools such as Nessus and/or Qualys.
Policy writing background is highly preferred.

Responsibilities

Lead and support information system security responsibilities throughout the RMF lifecycle, including ATO, continuous monitoring, and integration of security, privacy, and legal requirements.
Develop, maintain, and present security authorization packages and supporting documentation in accordance with client requirements and NIST SP 800-53.
Own security and privacy initiatives from planning through completion, managing tasks, driving remediation, validating corrective actions, and delivering accurate work on schedule.
Perform security and privacy risk assessments, analyze vulnerability scan results, recommend risk-based solutions, and support continuous monitoring across applications, infrastructure, and databases.
Advise CORs, system owners, business stakeholders, and technical teams on security and privacy requirements, communicating them clearly and professionally.
Develop, coordinate, test, and maintain contingency planning, incident response, privacy, and continuity activities, including PTAs, PIAs, HVA support, privacy training, and privacy-by-design integration throughout the SDLC.
Develop and maintain privacy policies, directives, SOPs, and operational guidance, ensuring compliance with applicable federal privacy laws, OMB guidance, NIST publications, CJIS Security Policy, and Legislative Branch requirements.
Build cross-functional relationships, manage concurrent priorities, identify process improvements, and maintain attention to detail across security and compliance activities.
Coordinate with internal and external stakeholders on audits, agency data calls, reporting requirements, asset inventories, and other compliance initiatives.