Role: Information System Security Officer (ISSO)
Company: Arch Systems
Location: Hybrid/Remote (DMV Region)
Employment Type: Full-Time
Clearance: Ability to obtain and maintain a Public Trust, Secret, or Top-Secret clearance, as required.
Position Summary
Arch Systems is seeking an experienced Information System Security Officer (ISSO) to support Federal Government programs. The ideal candidate will have extensive experience leading Assessment & Authorization (ATO) efforts, implementing the NIST Risk Management Framework (RMF), and ensuring continuous compliance for cloud and on-premise federal systems.
The ISSO will work closely with Government stakeholders, system owners, architects, developers, and operations teams to obtain and maintain ATOs while ensuring compliance with federal cybersecurity requirements.
Key Responsibilities
• Lead the complete ATO/RMF lifecycle (Initial ATO, ATO Renewal, Continuous Monitoring).
• Develop and maintain RMF documentation, including SSP, SAP, SAR, POA&M, Contingency Plans, Security Policies, Risk Assessments, and Security Impact Analyses.
• Manage and maintain A&A packages using eMASS, CSAM, Xacta, or similar GRC tools.
• Conduct security control assessments and ensure compliance with NIST SP 800-53 Rev. 5, NIST RMF, FISMA, FedRAMP, CISA guidance, and agency security policies.
• Coordinate vulnerability management, POA&M remediation, STIG compliance, patch management, and continuous monitoring activities.
• Support security audits, annual assessments, penetration testing, and ATO renewals.
• Collaborate with engineering teams to implement secure cloud architectures in AWS and Azure Government environments.
• Provide cybersecurity guidance throughout the System Development Life Cycle (SDLC) and support secure DevSecOps practices.
• Prepare executive-level security reports, risk assessments, and compliance status updates.
Required Qualifications
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience).
• 7+ years of Federal ISSO experience supporting civilian or DoD agencies.
• Demonstrated experience obtaining and maintaining Authority to Operate (ATO) for federal systems.
• Strong experience with NIST RMF, NIST SP 800-53 Rev. 5, FISMA, FedRAMP, and Continuous Monitoring.
• Hands-on experience with eMASS, CSAM, Xacta, or equivalent A&A platforms.
• Experience managing POA&Ms, vulnerability remediation, security assessments, and audit support.
• Working knowledge of AWS and/or Azure Government cloud security.
• Excellent communication, documentation, and stakeholder management skills.
Preferred Qualifications
• Experience supporting DHS, HHS, DOL, DoD, VA, Treasury, DOJ, or other Federal agencies.
• Knowledge of Zero Trust Architecture, OSCAL, C-SCRM, DevSecOps, Kubernetes, and AI security governance.
• Experience with security tools such as Tenable, Nessus, Qualys, Microsoft Defender, Microsoft Sentinel, Splunk, AWS Security Hub, GuardDuty, and Azure Defender.
Preferred Certifications
One or more of the following:
• CISSP (Preferred)
• CAP (Certified Authorization Professional)
• CISM
• Security+
• CASP+
• CCSP
• AWS Security Specialty
• Azure Security Engineer Associate
