[Hiring] Information System Security Officer @Commence

Role Description

The Information System Security Officer (ISSO) is the designated security officer and information assurance lead for the Commence systems that support federal programs. Reporting to the Information Systems Security Manager (ISSM), the ISSO owns the day-to-day security assessment, authorization, and continuous-monitoring work that keeps assigned systems authorized to operate for the federal agencies Commence supports directly as a prime contractor and indirectly as a subcontractor.

• Serve as the designated ISSO for assigned federal systems and the primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams.
• Partner with Project Managers to build security and authorization milestones into project plans.
• Run the Security Assessment and Authorization lifecycle under the NIST Risk Management Framework (SP 800-37).
• Maintain POA&Ms in agency GRC platforms and review monthly vulnerability and configuration scans.
• Lead system-level preparation for CMS Security Controls Assessments and other agency assessments.
• Maintain compliance with current and future agency requirements.
• Act as first responder for security and privacy incidents affecting federal data.
• Complete system-level contract security deliverables and manage federal personnel security tasks.
• Support the CIO and ISSM with internal audits and control assessments against various frameworks.

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems.
• Bachelor’s degree in a related field or equivalent experience.
• Experience with at least one federal system through an initial ATO or reauthorization under NIST SP 800-37/800-53.
• Working knowledge of at least two of: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publication 1075 & 4812, DHS 4300A.
• Comfortable reading vulnerability and configuration scan output and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• Clear, precise writer capable of managing multiple systems and deadlines.
• CompTIA Security+ (or higher DoD 8140-qualifying certification) required; CISSP, CGRC, CISA, or CCSP preferred.
• U.S. citizenship and ability to obtain and maintain federal Public Trust suitability required.

Requirements

• Remote position with an estimated 15-25% travel.
• Ability to sit, read, work on a computer, and watch a computer screen for extended periods of time.
• Occasionally required to stand, walk, use hands and fingers, kneel or crouch.
• Expected to participate in on-call coverage for security incidents.

Benefits

• Equal employment opportunity employer.
• Merit-based personnel processes without discrimination.
• Commitment to providing equal employment opportunities to all applicants, including individuals with disabilities.