Lead Information System Security Officer (Lead ISSO)

Job Description

Job Description

Lead Information System Security Officer (Lead ISSO)

Position Overview

The Lead Information System Security Officer will serve as the Contractor’s primary technical leader and single point of accountability for the delivery of ISSO support services to DFC’s Office of Information Technology Cybersecurity Division. The Lead ISSO will direct day-to-day cybersecurity activities, oversee assigned ISSO personnel, maintain consistent execution across supported systems, and coordinate closely with DFC’s Information System Security Manager, Chief Information Security Officer, Authorizing Official representatives, System Owners, federal ISSOs, and other cybersecurity stakeholders.

This is a hands-on technical leadership position. The Lead ISSO must be capable of directly performing complex ISSO and Risk Management Framework activities in addition to supervising and reviewing the work of other cybersecurity personnel.

Essential Duties and Responsibilities

• Direct the day-to-day execution of ISSO support activities across DFC-supported information systems.
• Serve as the Contractor’s primary technical interface with the Government-designated ISSM, CISO, AO/AODR, System Owners, federal ISSOs, Common Control Providers, Privacy Office, and other cybersecurity stakeholders.
• Provide technical and operational leadership to Senior ISSOs and other assigned cybersecurity personnel.
• Ensure consistent implementation of cybersecurity processes, standards, controls, documentation requirements, and quality expectations across approximately 32 supported information systems.
• Lead Risk Management Framework activities throughout the system lifecycle, including categorization, control selection, implementation, assessment, authorization, continuous monitoring, modification, and disposal.
• Oversee the preparation, review, quality control, and submission of authorization-package documentation and supporting evidence.
• Support development and maintenance of System Security Plans, security assessment documentation, control implementation statements, authorization artifacts, privacy documentation, contingency plans, interconnection documentation, and related cybersecurity records.
• Coordinate Authorization to Operate package development and readiness activities while preserving the Government’s authority to make final authorization and risk-acceptance decisions.
• Lead continuous-monitoring and security-posture-management activities, including review of control status, security findings, scan results, configuration compliance, patch compliance, account reviews, and authorization status.
• Oversee vulnerability management activities using Government-approved scanning, tracking, and reporting platforms.
• Direct POA&M development, validation, milestone tracking, aging analysis, remediation coordination, and closure-package preparation.
• Review proposed system changes and conduct or oversee security impact analyses.
• Coordinate cybersecurity participation in engineering review boards, configuration control boards, change advisory boards, and other technical governance forums.
• Support cybersecurity incident coordination, affected-system analysis, documentation updates, corrective-action tracking, and post-incident follow-up.
• Lead audit-readiness and compliance-support activities for FISMA, OMB, CISA, Inspector General, GAO, and other authorized reviews or data calls.
• Chair internal quality reviews before work products and deliverables are submitted to the Government.
• Validate that cybersecurity documentation is accurate, complete, current, traceable, and maintained in the appropriate authoritative repository.
• Maintain and manage the Contractor’s cybersecurity risk and issue register.
• Identify and escalate technical, operational, staffing, schedule, security, and compliance risks to appropriate Government and Contractor leadership.
• Participate in DFC cybersecurity governance meetings and represent the Contractor during technical reviews.
• Coordinate with the Contractor’s Program Manager regarding staffing, reporting, deliverables, invoicing support, transition activities, and overall contract performance.
• Support preparation of weekly activity reports, monthly program status reports, quarterly executive-review materials, metrics, trends, risks, and performance data.
• Maintain continuity of operations and coordinate with the designated Alternate ISSO during planned and unplanned absences.
• Support transition-in, knowledge transfer, system orientation, open-risk reviews, and operational-readiness activities.
• Complete all required DFC cybersecurity, privacy, records-management, rules-of-behavior, insider-threat, and role-based training.

Required Qualifications

• Substantial experience performing ISSO, information security, cybersecurity compliance, or security-control-assessment work in a federal environment.
• Demonstrated experience leading cybersecurity personnel or multidisciplinary security workstreams.
• Hands-on experience implementing the NIST Risk Management Framework and NIST SP 800-37.
• Strong knowledge of NIST SP 800-53 controls, FISMA, FedRAMP, federal continuous-monitoring requirements, POA&M management, and authorization-package development.
• Experience supporting FISMA Moderate systems, General Support Systems, major or minor applications, cloud environments, and shared-responsibility models.
• Experience developing, reviewing, and maintaining cybersecurity documentation and audit-ready evidence.
• Demonstrated experience with vulnerability management, configuration compliance, incident coordination, audit support, security impact analysis, and cybersecurity governance.
• Ability to lead internal quality reviews and identify incomplete, inaccurate, unsupported, or noncompliant cybersecurity deliverables.
• Strong written and verbal communication skills, including the ability to brief senior Government and Contractor stakeholders.
• Ability to manage multiple systems, competing priorities, deadlines, risks, and dependencies.
• U.S. citizenship.
• Eligibility to obtain and maintain a Tier 4 High-Risk Public Trust determination.
• Availability to support required Eastern Time coverage and occasional time-sensitive incident-response coordination.

Desired Education and Certifications

• Bachelor’s degree in cybersecurity, information technology, computer science, information systems, engineering, or a related discipline.
• Advanced degree in a cybersecurity, technology, or management-related field.
• CISSP, CGRC/CAP, CISM, Security+, CASP+, or another relevant industry-recognized cybersecurity certification.
• Prior experience supporting a federal CISO organization, federal ISSM, Authorizing Official, or federal cybersecurity governance program.
• Previous Tier 4 Public Trust determination or an active federal background investigation that may qualify for reciprocity.

Technical Environment

Candidates should possess experience with or the ability to become proficient in:

• CSAM or a comparable federal GRC and authorization platform
• ServiceNow ITSM and change-management modules
• Splunk SIEM and log analytics
• Tenable Nessus or Qualys
• Microsoft Defender for Endpoint, Identity, Cloud, and Microsoft 365
• Microsoft Azure Government and Microsoft 365 GCC/GCC High
• Microsoft Entra ID and Okta
• Microsoft Intune and BigFix
• Palo Alto Panorama and Zscaler
• FedRAMP-authorized cloud environments
• Zero Trust-aligned enterprise security environments