Senior Information System Security Officer (ISSO)

Join Our Team Devis is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector. About This Role As a Senior ISSO, you will perform senior ISSO duties for assigned systems and lead an assigned area of the program spanning authorization, continuous monitoring, vulnerability and POA&M management, audit support, and compliance. You will work directly in the agency’s compliance platform rather than around it, and you will be expected to produce artifacts a federal assessor can accept without a round of rework. What You’ll Do Maintain Authorization Packages Maintain authorization packages, control implementation statements, inheritance records, and POA&M items in CSAM for assigned systems Develop and recommend system security categorizations and control baselines, documenting tailoring rationale Reconcile inherited controls against current cloud provider and common control provider documentation Keep records audit-ready and internally consistent between the compliance platform and supporting repositories Run Continuous Monitoring Execute continuous monitoring plans: recurring security reviews, Splunk log ingestion verification, and monthly posture reporting Analyze vulnerability scan results from Tenable, Qualys, and Microsoft Defender; validate findings and document false-positive rationale with supporting evidence Coordinate remediation with engineering teams and track POA&M items to closure with bidirectional ServiceNow traceability Produce monthly reporting that gives federal stakeholders analysis and recommended action, not raw data extracts Analyze Change and Support Governance Prepare security impact analyses for change requests within contract turnaround times Support change advisory and change control board meetings, and perform post-change verification Analyze proposed changes for significant-change implications and prepare the resulting assessment packages Support Incidents and Audits Provide ISSO-side incident response coordination: affected-system context from CSAM within one business hour of declaration, situation reports, root cause analysis inputs, and corrective action tracking Support audits, assessments, and FISMA reporting through evidence staging, auditor coordination, draft finding responses, and corrective action plans Cover the Lead Step into Lead ISSO duties during planned and unplanned absences without a drop in service Represent the team in agency governance forums when the Lead is unavailable Lead internal quality reviews of deliverables when acting in the Lead role Areas of Focus Both positions carry the identical qualification bar and both must be able to assume the Lead ISSO role. They differ only in primary area of ownership, and each area has a trained backup so that no part of the program depends on one person. Monitoring and Remediation: primary owner of continuous monitoring and security posture management and of vulnerability and POA&M execution, and the coordination point for incident response Authorization and Assurance: primary owner of security documentation and artifact management, security impact analysis and change coordination, and audit, assessment, and compliance support, working alongside the Lead ISSO on authorization efforts. Depth in CSAM is prioritized for this position. Both positions are cross-trained across these areas and work staggered schedules to cover the core business day. What We’re Looking For Required Qualifications Education & Experience Bachelor’s degree in cybersecurity, computer science, information systems, or a related technical discipline Minimum 8 years of ISSO, security control assessment, or Risk Management Framework experience supporting federal information systems Demonstrated production of RMF artifacts: System Security Plans, control implementation statements, assessment evidence, and POA&Ms Readiness to assume Lead ISSO responsibilities, including governance-forum representation and internal quality review leadership Required Certifications CISSP, CGRC (formerly CAP), or CASP+, or a comparable certification Technical Skills Hands-on proficiency with CSAM. A comparable federal governance, risk, and compliance platform such as eMASS or ArchAngel considered where you can demonstrate the ability to transition to CSAM ServiceNow, Splunk, and at least one enterprise vulnerability scanner Working knowledge of NIST SP 800-37 Revision 2, NIST SP 800-53, and NIST SP 800-137 Clear technical writing that stands up to federal review without rework Preferred Qualifications FedRAMP shared-responsibility documentation experience Microsoft Azure Government and Microsoft 365 GCC High familiarity Privacy documentation support, including Privacy Threshold Analyses and Privacy Impact Assessments Experience with Microsoft Defender for Endpoint, Identity, and Cloud Current or recent Tier 4 High-Risk Public Trust adjudication, or higher Performance Expectations Success in this role means: Authorization records for assigned systems accurate, current, and internally consistent Findings triaged and reported inside contract turnaround times Monthly reporting federal stakeholders can act on directly Able to cover the Lead role on short notice without a dip in service Special Requirements Primarily remote, with in-person presence required at DFC headquarters in Washington, DC on an as-needed basis for governance meetings, audits, and assessments. Candidates based in the Washington, DC metropolitan area are preferred. Authorization to work in U.S. without restriction. Must be eligible for and able to obtain a Tier 4 High-Risk Public Trust background investigation. Adjudication must be complete before privileged access to enterprise security tools or authorization repositories is granted. Must obtain and maintain an agency-issued PIV card. Must complete agency cybersecurity, privacy, records management, insider threat, and applicable role-based training on entry and annually thereafter. Availability during core business hours, 7:00 a.m. to 6:00 p.m. Eastern, Monday through Friday, excluding federal holidays, and participation in a shared on-call rotation for off-hours incident acknowledgment. Compensation & Benefits $99,000.00 - $109,000.00 salary commensurate with experience and qualifications. This position is contingent upon contract award. Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.