Job Title

Xacta SaaS Information System Owner (ISO)

Job Description

This position will be based at Ashburn, VA

We are seeking an experienced Information System Owner (ISO) to provide security, risk, compliance, and authorization leadership for a FedRAMP-authorized Cloud Service Offering (CSO). The ISO will serve as the accountable operational owner for maintaining the system's availability, security and authorization/certification posture, ensuring that the production environment remain aligned with applicable FedRAMP and NIST requirements.

This role requires a combination of cybersecurity expertise, cloud and DevSecOps knowledge, risk-management judgment, and the ability to coordinate activities across engineering, operations, security, compliance, product, and executive stakeholders. The successful candidate will be able to translate regulatory requirements into practical operational controls while identifying opportunities to automate compliance activities and reduce the cost and effort required to maintain authorization.

Responsibilities:
• Serve as the primary operational owner for the CSO's FedRAMP Certification and operational posture.
• Maintain alignment among the production environment, authorization boundary, System Security Plan (SSP), security controls, architecture documentation, inventories, policies, procedures, and supporting evidence.
• Coordinate FedRAMP continuous monitoring activities and required recurring deliverables.
• Oversee availability, vulnerability management, remediation tracking, POA&M activities, deviations, exceptions, and risk-acceptance processes.
• Evaluate infrastructure, application, architecture, and configuration changes for security, compliance, and authorization impact.
• Coordinate control owners and technical teams to ensure NIST SP 800-53 security requirements are appropriately implemented and evidenced.
• Partner with DevSecOps and engineering teams on secure cloud architecture, CI/CD processes, configuration management, IAM, logging, encryption, vulnerability management, and related security capabilities.
• Coordinate responses to 3PAO assessments, annual assessments, penetration testing, government reviews, customer inquiries, and evidence requests.
• Evaluate findings and security issues based on technical severity, operational impact, regulatory requirements, and overall system risk.
• Escalate significant risks, compliance deficiencies, and authorization concerns to appropriate technical and executive stakeholders.
• Support incident response, contingency planning, system recovery, and related FedRAMP operational security requirements.
• Identify opportunities to automate security and compliance activities, including control evidence collection, asset reconciliation, vulnerability workflows, compliance telemetry, and recurring reporting.
• Develop security and risk metrics that provide leadership with visibility into the CSO's operational and authorization posture.
• Promote continuous improvement of security, compliance, and DevSecOps processes.

Job Requirements

Required Qualifications:
• US Citizen
• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related discipline, or equivalent combination of education and relevant professional experience.
• One or more relevant professional certifications such as CISSP, CISM, CCSP, CGRC, comparable cybersecurity credentials.
• Approximately 5 - 7 years or more of progressive experience in cybersecurity, information assurance, cloud security, security operations, or related disciplines.
• Demonstrated experience supporting FedRAMP, NIST Risk Management Framework (RMF), FISMA, or comparable federal security authorization environments.
• System Security Plans, Plans of Action and Milestones (POA&M's), continuous monitoring, vulnerability management, security control assessments, control evidence collection, and risk-management activities.
• Experience with Xacta or other GRC platforms
• Experience operating or securing enterprise cloud or SaaS environments.
• Working knowledge of cloud security concepts including identity and access management, network security, encryption, logging and monitoring, vulnerability scanning, configuration management, and incident response.
• Ability to interpret technical vulnerability, configuration, and security data and translate findings into remediation priorities and risk decisions.
• Experience coordinating security activities across engineering, operations, cybersecurity, and compliance teams.
• Experience supporting security assessments, audits, or independent third-party assessments.
• Strong analytical, written, verbal, and executive communication skills.
• Ability to communicate technical and regulatory issues effectively to both technical and non-technical stakeholders.

Preferred Qualifications:
• Direct experience supporting or maintaining a FedRAMP CSO environment.
• AWS certification; or related cloud security certification
• Working knowledge and use of Artificial Intelligence (AI) Tools, prompt engineering and agentic workflows
• Experience interacting directly with 3PAOs, government assessors, or authorizing organizations.
• Experience with DevSecOps environments, CI/CD pipelines, containers, Kubernetes, infrastructure as code, and automated security tooling.
• Experience with API Security, automated evidence collection, and continuous control monitoring.
• Familiarity with FedRAMP 20x and machine-readable security and compliance standards like OSCAL.
• Experience integrating security telemetry from vulnerability scanners, cloud platforms, SIEM systems, CI/CD pipelines, and related security tools.
• Experience supporting federal government customers or regulated cloud environments.

The successful candidate must meet eligibility requirements to access sensitive information, which requires US citizenship.

Job Type

Full-Time

Location

Ashburn, VA 20147 US (Primary)