7-10 years of experience in Information Assurance or cybersecurity compliance.
Bachelor's degree required; Master's preferred, or equivalent experience considered.
In-depth knowledge of the Risk Management Framework (RMF) and NIST security controls.
Experience with vulnerability scanning tools like Tenable or Qualys.
Strong analytical skills for complex security issue resolution.
Hands-on experience with Agile methodologies and DevSecOps frameworks.
Responsibilities
Navigate the RMF lifecycle in compliance with FISMA requirements.
Conduct continuous monitoring activities, including audit log reviews.
Coordinate with system admins to implement security hardening guidelines.
Develop and maintain critical security documentation like SSPs and POA&Ms.
Gather and track compliance artifacts for audits.
Utilize government GRC systems for record maintenance.
Report security incidents to the ISSM and response teams.
Benefits
Opportunity to work on critical federal and defense systems.
Engagement with a variety of government agencies.
Professional development in a highly regulated environment.
Collaboration with DevSecOps and IT operations teams.
Potential for career advancement in cybersecurity.
Full Job Description
Clearance Level: Secret
US Citizenship: Required
Job Classification: Regular, Full-Time
Location: Reston, VA Years of Experience: 7-10 Years of Experience
Education Level: Bachelor's Degree, Master's Degree preferred. Experience may be considered in place of education requirement.
Salary: The salary offered within this range will depend on the candidate's relevant experience, qualifications, and security clearance.
Briefly Describe the Work: GITI is seeking an Information Systems Security Officer (ISSO) to ensure the confidentiality, integrity, and availability of critical federal and defense systems to support a General Services Administration (GSA) contract. You will play a vital role in navigating the Risk Management Framework (RMF) lifecycle by conducting continuous monitoring and ensuring compliance with federal mandates. The ideal candidate is highly organized, detail-oriented, and excels at tracking compliance artifacts and vulnerability remediation within highly regulated environments across various government agencies.
Core Responsibilities:
Navigate the system through the 6-step Risk Management Framework (RMF) lifecycle in accordance with FISMA requirements.
Conduct daily, weekly, and monthly continuous monitoring activities, including audit log reviews and account management audits.
Coordinate with system administrators to apply security hardening guidelines (e.g., DISA STIGs, CIS Benchmarks) and track the remediation of vulnerability scan results.
Develop, maintain, and update critical security documentation, including System Security Plans (SSPs) and Plan of Action & Milestones (POA&Ms).
Gather and track artifacts and evidence to prove control compliance for internal and external audits.
Utilize and maintain records within government Governance, Risk, and Compliance (GRC) systems (e.g., eMASS, Xacta, CSAM, or Archer).
Report security incidents or unauthorized activities immediately to the ISSM and appropriate incident response teams.
Required Skills:
Professional experience in Information Assurance, cybersecurity compliance, or systems administration.
Deep understanding of the RMF process (NIST 800-37) and NIST 800-53 security controls.
Familiarity with agency-specific control overlays and policies (e.g., CNSSI 1253 for the IC, DHS 4300A, or DoD SRGs).
Experience with vulnerability scanning and auditing tools (e.g., Tenable/Nessus/ACAS, Qualys, Splunk).
Excellent problem-solving and analytical skills to track complex security issues.
Demonstrated hands-on experience in Agile delivery models (ex. SCRUM, Kanban, SAFe) and a DevSecOps framework.
Desired Skills:
Experience working alongside DevSecOps and IT operations teams.
Familiarity with zero-trust network principles.
Preferred Certifications:
DoD 8140/8570 IAM/IAT Level II certification (e.g., Security+ CE, CAP/CGRC, or CySA+)
