HHS - Sr. ISSO

cFocus Software Incorporated•Rockville, MD

2d•Remote

About The Position

cFocus Software seeks a Sr. ISSO to join our program supporting the Department of Health and Human Services (HHS) This position is remote. This position requires the ability a Public Trust clearance. Qualifications: Bachelor’s degree in Cybersecurity, Information Technology, or related field. Minimum 8–10 years of experience supporting federal RMF and ISSO functions. Expert knowledge of NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, and FISMA requirements. Hands-on experience supporting ATOs, continuous monitoring, and eGRC tools (e.g., RSA Archer). Experience supporting systems containing PII and moderate/high impact data. Strong written and verbal communication skills. Active CISSP, CAP, CISM, or Security+ (preferred) Duties: Lead execution of the NIST RMF lifecycle (Categorize, Select, Implement, Assess, Authorize, Monitor) for assigned HRSA systems. Serve as the primary security advisor to System Owners, ISSOs, and program leadership. Develop, review, and maintain RMF artifacts including SSPs, SARs, POA&Ms, Continuous Monitoring Plans, BIAs, and Contingency Plans. Ensure accurate and timely entry of system security data into the HRSA eGRC platform. Manage POA&M development, prioritization, tracking, and closure in coordination with stakeholders. Prepare systems for initial ATOs, annual assessments, and ongoing authorization activities. Support Security Control Assessments (SCAs) and remediate findings in coordination with assessors. Develop Risk-Based Decisions (RBDs) and support Authorizing Official (AO) adjudication. Maintain acceptable CPIC dashboard scores and support corrective actions. Ensure compliance with FISMA, OMB A-130, HHS, and HRSA cybersecurity policies. Support vulnerability management, incident response, and configuration management activities. Provide mentoring and technical guidance to junior ISSOs and RMF analysts. Develop and maintain system security SOPs, workflows, and documentation. Prepare executive briefings, metrics, and reports on system security posture and risk.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, or related field.
Minimum 8–10 years of experience supporting federal RMF and ISSO functions.
Expert knowledge of NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, and FISMA requirements.
Hands-on experience supporting ATOs, continuous monitoring, and eGRC tools (e.g., RSA Archer).
Experience supporting systems containing PII and moderate/high impact data.
Strong written and verbal communication skills.

Nice To Haves

Active CISSP, CAP, CISM, or Security+ (preferred)

Responsibilities

Lead execution of the NIST RMF lifecycle (Categorize, Select, Implement, Assess, Authorize, Monitor) for assigned HRSA systems.
Serve as the primary security advisor to System Owners, ISSOs, and program leadership.
Develop, review, and maintain RMF artifacts including SSPs, SARs, POA&Ms, Continuous Monitoring Plans, BIAs, and Contingency Plans.
Ensure accurate and timely entry of system security data into the HRSA eGRC platform.
Manage POA&M development, prioritization, tracking, and closure in coordination with stakeholders.
Prepare systems for initial ATOs, annual assessments, and ongoing authorization activities.
Support Security Control Assessments (SCAs) and remediate findings in coordination with assessors.
Develop Risk-Based Decisions (RBDs) and support Authorizing Official (AO) adjudication.
Maintain acceptable CPIC dashboard scores and support corrective actions.
Ensure compliance with FISMA, OMB A-130, HHS, and HRSA cybersecurity policies.
Support vulnerability management, incident response, and configuration management activities.
Provide mentoring and technical guidance to junior ISSOs and RMF analysts.
Develop and maintain system security SOPs, workflows, and documentation.
Prepare executive briefings, metrics, and reports on system security posture and risk.