Information System Security Officer

Job Description

Job Description

Information System Security Officer (ISSO)

Job Summary

PKH Enterprises is seeking experienced Information System Security Officers (ISSOs) to support cybersecurity and information assurance activities within a federal environment. The ISSO will provide hands-on cybersecurity support for assigned information systems throughout the system lifecycle, maintaining visibility into authorization status, security posture, vulnerabilities, and cybersecurity risk.

The successful candidate will work closely with Information System Security Managers (ISSMs), system owners, security engineers, Security Control Assessors (SCAs), technical teams, and other stakeholders to maintain system authorizations and ensure compliance with federal cybersecurity requirements.

Key Responsibilities

• Serve as the ISSO for assigned information systems and support cybersecurity activities throughout the complete system lifecycle.
• Execute and support all phases of the NIST Risk Management Framework (RMF) and system authorization process.
• Maintain accurate information regarding system lifecycle stage, authorization status, ATO expiration, security controls, vulnerabilities, and overall risk posture.
• Develop, maintain, and update RMF and authorization documentation, including:
• • System Security Plans (SSPs)
  • Security Assessment Plans (SAPs)
  • Security Assessment Reports (SARs)
  • Plans of Action and Milestones (POA&Ms)
  • Risk assessments
  • Contingency plans
  • Incident response plans
  • Supporting security artifacts
• Support system categorization, security control selection and tailoring, inherited controls, control implementation, assessment, authorization, and continuous monitoring activities.
• Coordinate with system owners and technical teams to obtain, review, and validate security control implementation evidence.
• Maintain version control and quality of RMF documentation and supporting security artifacts.
• Prepare systems for independent Security Control Assessments (SCAs), including implementation readiness activities and collection and validation of supporting evidence.
• Identify, document, track, and manage cybersecurity risks, vulnerabilities, and remediation activities throughout the POA&M lifecycle.
• Review vulnerability and compliance findings from security assessment and monitoring tools and translate technical findings into risk and remediation activities.
• Track vulnerability findings and support remediation in accordance with applicable federal cybersecurity requirements, CISA directives, and organizational policies.
• Support continuous monitoring activities to ensure systems maintain an acceptable security posture and authorization documentation remains current.
• Support FISMA reviews, cybersecurity audits, data calls, compliance reporting, and related cybersecurity initiatives.
• Develop and maintain supporting security artifacts such as evidence indexes, inherited control matrices, system boundary documentation, data flow diagrams, and control implementation statements.
• Support security requirements for new and existing systems throughout the SDLC and DevSecOps lifecycle.
• Support cloud and hybrid system authorization activities, including FedRAMP control inheritance and cloud security requirements.
• Participate in cybersecurity risk management activities and provide recommendations to system owners, ISSMs, security engineers, and other stakeholders.
• Support post-incident activities and ensure relevant findings are incorporated into risk assessments, POA&Ms, SSPs, and control implementation statements.

Required Qualifications

• Minimum of 5 years of cybersecurity experience, including experience as an ISSO or performing Information Assurance (IA), Assessment & Authorization (A&A), RMF, or comparable cybersecurity responsibilities.
• Demonstrated experience supporting federal information systems through the RMF and ATO lifecycle.
• Strong knowledge of:
• • NIST SP 800-37
  • NIST SP 800-53
  • NIST SP 800-60
  • FISMA
  • FIPS 199/200
• Experience developing and maintaining SSPs, SAPs, SARs, POA&Ms, risk assessments, and other authorization artifacts.
• Experience assessing security controls and validating implementation evidence.
• Experience with vulnerability management, remediation tracking, and continuous monitoring activities.
• Experience using enterprise Governance, Risk, and Compliance (GRC) platforms to manage authorization packages, security controls, and POA&Ms.
• Ability to interpret vulnerability and compliance findings from enterprise security tools and translate findings into actionable remediation activities.
• Understanding of Security Technical Implementation Guides (STIGs), CISA Known Exploited Vulnerabilities (KEV), Binding Operational Directives (BODs), vulnerability remediation, and configuration compliance.
• Strong written and verbal communication skills with the ability to communicate cybersecurity risks to technical and non-technical stakeholders.
• Experience supporting federal cybersecurity environments.
• Active Secret security clearance.

Preferred Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, or a related discipline. Relevant professional experience may be substituted for education where appropriate.
• Professional cybersecurity certifications such as:
• • CISSP
  • CAP
  • Security+
  • CISM
  • GSLC
• Experience supporting the U.S. Department of State or other federal civilian agencies.
• Experience with cloud environments and FedRAMP-authorized platforms.

\nCompany Description

PKH Enterprises (PKH) is a small, woman-owned professional services firm dedicated to helping clients address challenging policy and technology issues. The PKH team is comprised of professionals with varied backgrounds combining legal, policy and technical expertise and offers the services and experience of business process engineers, senior subject matter experts and certified project managers. Our diverse capabilities help our clients improve performance and achieve innovative solutions to their most complex business problems. Our clients turn to us as partners and trusted advisors, and depend on our ability to anticipate, recognize and address their specific needs. PKH has a reputation for excellence and remains dedicated to generating successful results for tasks at all levels of project execution.

To all recruitment agencies: PKH Enterprises does not accept unsolicited agency resumes/CVs. PKH Enterprises is not responsible for any fees related to unsolicited resumes/CVs.

PKH Enterprises is an Equal Opportunity Employer.

Company Description

PKH Enterprises (PKH) is a small, woman-owned professional services firm dedicated to helping clients address challenging policy and technology issues. The PKH team is comprised of professionals with varied backgrounds combining legal, policy and technical expertise and offers the services and experience of business process engineers, senior subject matter experts and certified project managers. Our diverse capabilities help our clients improve performance and achieve innovative solutions to their most complex business problems. Our clients turn to us as partners and trusted advisors, and depend on our ability to anticipate, recognize and address their specific needs. PKH has a reputation for excellence and remains dedicated to generating successful results for tasks at all levels of project execution. \r\n\r\nTo all recruitment agencies: PKH Enterprises does not accept unsolicited agency resumes/CVs. PKH Enterprises is not responsible for any fees related to unsolicited resumes/CVs.\r\n\r\nPKH Enterprises is an Equal Opportunity Employer.