Senior ISSO / Alternate Lead ISSO

E Logic•Washington, DC

1d•Hybrid

About The Position

Seeking a highly experienced Senior Information System Security Officer (ISSO) / Alternate Lead ISSO to provide senior-level cybersecurity compliance, risk management, and authorization support to the U.S. International Development Finance Corporation (DFC), Office of Information Technology (OIT), Cybersecurity Division. This role serves as the designated alternate to the Lead ISSO and provides senior-level ISSO support, continuity of operations, and coverage as necessary. The Senior ISSO / Alternate Lead ISSO is qualified to assume Lead ISSO duties during scheduled or unscheduled absences and maintains operational continuity in the Lead ISSO's absence. This is a non-personal services contract position. The contractor employee reports to the Prime Contractor for HR and administrative matters, while receiving work direction from the Government ISSM and COR. Hybrid position: minimum 2 days/week on-site at DFC Headquarters, Washington, DC; balance remote (CONUS). No travel required.

Requirements

Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, or related field (or equivalent experience)
Minimum 7 years cybersecurity experience, with at least 3 years in ISSO or RMF support
Experience supporting federal agencies with FISMA Moderate systems
Hands-on experience with NIST SP 800-37 Rev. 2, SP 800-53 Rev. 5, SP 800-53B, FIPS 199, SP 800-60, SP 800-137, SP 800-128, SP 800-30, and SP 800-30
Experience with FISMA, OMB A-130, OMB M-22-09 (Zero Trust), and CISA BODs/EDs
Experience with FedRAMP-authorized cloud services and shared-responsibility models (Azure Government, M365 GCC/GCC High, ServiceNow)
Hands-on experience with CSAM (or equivalent GRC), ServiceNow (ITSM), Splunk (SIEM), Qualys/Tenable, and Microsoft Defender
Experience with POA&M lifecycle management, risk acceptance coordination, and closure evidence validation
Experience with SIA, CAB/CCB/ERB governance, incident response coordination, and audit readiness
Experience with security documentation and artifact management (SSP, POA&M, ConMon Plan, IRP, CP, PTA, PIA, ROB, SIA records, ISAs, MOU/MOA, SOPs, runbooks)
U.S. Citizenship required
Must be eligible for and capable of obtaining a Tier 4 High-Risk Public Trust background investigation
Fluent in written and verbal English
Proficiency in CSAM, ServiceNow, Splunk, Qualys, Microsoft Defender, Intune, BigFix, Entra ID, Okta, Palo Alto Panorama, and Zscaler
Must comply with DFC security regulations and safeguard CUI
Must pass background checks and suitability determinations
Must complete DFC IT Security Awareness Training annually
Must sign and comply with DFC Rules of Behavior
Must maintain Tier 4 Public Trust eligibility and required certifications
Must be available during core hours (7:00 AM - 6:00 PM ET, M-F, excluding federal holidays)
Occasional after-hours coordination as directed (no 24/7 on-call)
Must report on-site minimum 2 days/week at DFC HQ
Must not perform billable ISSO support requiring system access before suitability determination (except transition-in activities authorized in writing by the COR)

Nice To Haves

CISSP, CISM, CAP, or equivalent cybersecurity certification
Experience serving as a back-up to a Government ISSM or Lead ISSO
Experience advising project teams and Senior Management on cybersecurity compliance
Experience with Zero Trust architecture and OMB M-22-09 implementation
Experience with CISA KEV, BOD 22-01, and Emergency Directive response
Experience with FedRAMP customer-responsibility and inherited-control reconciliation
Experience with privacy documentation support (PTA, PIA, SORN review inputs)
Experience with tabletop exercises and IRP testing

Responsibilities

Serve as designated alternate to the Lead ISSO; assume Lead ISSO duties during scheduled or unscheduled absences
Maintain operational continuity in the absence of the Lead ISSO
Perform senior ISSO duties for assigned systems as directed by the Lead ISSO
Support consistent execution of ISSO activities across assigned systems
Lead assigned RMF, ConMon, vulnerability management, POA&M, audit-support, and compliance workstreams
Maintain proficiency in CSAM, ServiceNow, Splunk, Qualys, Microsoft Defender, Intune, BigFix, Entra ID, Okta, Palo Alto Panorama, and Zscaler
Provide RMF and authorization support per NIST SP 800-37 Rev. 2 (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor)
Support Continuous Monitoring per NIST SP 800-137, including monthly ConMon reporting, quarterly access recertification, and annual SSP currency reviews
Support vulnerability management and POA&M lifecycle, including critical/emergency vulnerability response, CISA KEV/BOD 22-01 compliance, and monthly ServiceNow-to-CSAM reconciliation
Support SIA and change coordination for CAB/CCB/ERB governance, including standard, expedited, and emergency changes
Provide ISSO-level incident response coordination to DFC SOC/IR team, including CSAM context pull, Splunk log-verification, SitReps, RCA inputs, and corrective action tracking
Support audit, assessment, and compliance activities, including FISMA reporting, evidence coordination, and audit finding remediation
Support security documentation and artifact management (SSP, POA&M, ConMon Plan, IRP, CP, PTA, PIA, ROB, SIA records, ISAs, MOU/MOA, SOPs, runbooks)
Maintain Tier 4 Public Trust eligibility; complete all mandatory DFC training
Comply with DFC security regulations and safeguard CUI