Information Security Steward / ISSO Liaison

Summary

As Information Security Steward, you'll embed with the agency's System Security and Privacy Officer (ISSO) on a federal IT modernization program to maintain ATO posture, manage SSPs and POA&Ms, and ensure NIST RMF and FISMA compliance across all delivered systems. You're the bridge between the developers shipping dashboards and SharePoint solutions and the security organization that has to certify them safe to operate. The role spans both compliance documentation and operational security: you'll run software assurance scans, drive vulnerability remediation, advise system owners on procurement and lifecycle security considerations, and produce the artifacts that keep the program's ATO current. This is not a paperwork-only ISSO seat — it's a builder-aware compliance role on a working federal program.

Responsibilities

Security Steward & ISSO support

• Serve as Developer–Subject-Matter-Expert, Security Steward; assist the customer ISSO in coordinating software assurance scans, remediating identified vulnerabilities, and maintaining compliance with NIST and FISMA
• Maintain software with the latest updates, patches, and new features for tools, libraries, and platforms used in data visualization and SharePoint environments, and stay informed about changes affecting implemented solutions
• Serve as liaison between developers, system owners, and security staff to ensure compliance

Compliance documentation & ATO

• Maintain security documentation including SSPs, POA&Ms, and artifacts for Authorization to Operate (ATO)
• Deliver security compliance documentation on the customer's approved schedule
• Assist the customer in planning and documenting Security Assessment and Authorization (SAA) requirements for projects requiring Certification and Accreditation (C&A); coordinate with security officers and apply NIST Special Publications to define system requirements

NIST RMF, FISMA & advisory

• Assist the customer ISSO in executing the agency's implementation of the NIST Risk Management Framework, FISMA oversight/compliance obligations, and OMB directives
• Support business stewards and system owners in carrying out RMF implementation in accordance with FISMA, OMB directives, FIPS, and federal policy
• Support security program assignments including data calls, incident/breach response, FISMA reporting, and requests for comments
• Advise business stewards and system owners on security considerations across procurement, development, implementation, operation, maintenance, and disposal activities

Federal security & privacy requirements

• Ensure compliance with HSPD-12, NIST SP 800-53 / 800-171, FIPS 140 validation requirements, CUI handling under EO 13556, and federal records retention policy

Required

• 7+ years federal information security; direct experience supporting an ISSO or SSPO
• Active CISSP required; CAP, CGRC, or Security+ acceptable as additional
• Demonstrated execution of NIST RMF, FISMA, NIST SP 800-53, NIST SP 800-171 in operational environments
• Hands-on production of SSPs, POA&Ms, and ATO artifacts
• Experience advising system owners on procurement and lifecycle security considerations
• Software assurance scanning and vulnerability remediation experience

Ideal Candidate

A compliance-fluent operator, not a checkbox auditor. You've sat next to a federal ISSO during an ATO push and stayed there through remediation. You can read an SSP, edit a POA&M, and explain a control gap to a developer in the same conversation. You know the difference between security theater and security work, and you've done the second. You're as comfortable in NIST SP 800-53 as you are in a vulnerability scanner output.

Clearance: Federal Public Trust (Tier 4 / High Risk); HSPD-12 PIV; existing federal clearances transferable

Pay: $78,051.83 - $93,997.90 per year

Benefits:

• 401(k)
• Dental insurance

Work Location: Hybrid remote in Washington, DC 20591