Information System Security Officer - ISSO
$85.9k - $202.3k/yr
Senior
Washington, DC, USA
In PersonOn-site in Washington, DC.
CybersecuritySecurity Governance, Risk & Compliance
About the job
Requirements
- At least 6 years of experience with the National Institute of Standards and Technology (NIST), Federal Information Security Management Act (FISMA), and Security Assessment and Authorization.
- Experience with Federal Risk and Authorization Management Program (FedRAMP) and cloud environments such as Azure, Amazon Web Services, or Oracle Cloud Infrastructure.
- Knowledge of NIST publications including Special Publication 800-53 Revision 5, Special Publication 800-53A, and Special Publication 800-18 Revision 1.
- In-depth knowledge of the Risk Management Framework (RMF).
- Ability to obtain and maintain a customer Public Trust clearance.
- Certified Information Systems Security Professional (CISSP) certification.
Responsibilities
- Participate as an integral team member in the agency's risk assessment program by performing internal audits and building streamlined assessment processes.
- Manage the security of a system's accreditation boundary across multi-cloud and on-premises environments involving multiple vendors, customers, and anything-as-a-service products.
- Evaluate current system infrastructure and recommend changes to improve the agency's security posture.
- Provide customer support for security compliance and audit liaison activities, with a focus on the agency's Forensic and Investigative Labs.
- Develop, maintain, and assess Security Assessment and Authorization packages resulting in an Authority to Operate for information systems.
- Create and maintain System Security Plans and supporting documentation in accordance with agency guidelines and directives, including implementation statements, Contingency Plans, Incident Response Plans, and Account Management Plans.
- Perform self-assessments and peer assessment reviews while working with system stakeholders.
- Develop, coordinate, test, and train personnel on Incident Response Plans and Contingency Plans.
- Ensure that information systems are accredited, maintain their Authority to Operate, and are continuously monitored.
- Perform risk assessments for agency systems and applications, including cloud-based systems.
- Perform security control assessments by collecting supporting artifacts and evidence and interviewing system owners or owner representatives.
- Maintain and track system Plans of Action and Milestones.
- Review and analyze vulnerability scan data and provide remediation recommendations.
- Take ownership of various projects.
- Improve processes and procedures and recommend ways to improve the security posture of the agency's information technology systems and applications.
Desired Qualifications
- Familiarity with the security control families in the NIST guidance covered by the documents being evaluated.
- Subject matter expert-level knowledge to ensure project-team compliance with applicable requirements.
- Knowledge of information technology security policy implementation statements, the regulatory structure of policy, and the roles of the Department of Homeland Security, Office of Management and Budget, and NIST.
- Hands-on experience with Governance, Risk, and Compliance tools such as JCAM (CSAM) or eMASS.
- Ability to conduct gap analyses on non-federated vendor audit results, including SOC Type 2 and HIPAA comparison reviews, against NIST Special Publication 800-53 Revision 5 security controls.
- Hands-on experience providing C-level presentations and reporting.
- Excellent written communication skills and understanding of the purpose and use of the System Security Plan.
- Understanding of control inheritance as applied to Risk Management Framework implementation in the JCAM tool.
- Ability to manage complex workstreams, apply the Risk Management Framework, and understand security controls across interface, application, operating system, network, and database layers of modern information systems, including the artifacts used as evidence to assess compliance.
- Experience with security-function tools including vulnerability management tools such as Nessus, configuration management tools such as BigFix, SCCM, and ePO, endpoint protection tools such as antivirus and ATP, data loss prevention tools, and intrusion detection software and hardware.
- Ability to evaluate data flows, network diagrams, and logical security boundaries.
- Excellent oral and written communication skills.
- Familiarity with data analysis tools, including Microsoft Excel and Power BI, to combine data from multiple sources.
About the company
AnaVation provides IT engineering services to the U.S. Federal Government, focusing on complex technical and analytical challenges. It works by delivering contract-based projects that cover intelligence collection and processing, analytical systems, big data solutions, and cybersecurity, using cross-disciplinary engineering teams (called AnaVators) to tailor solutions to government needs. The company differentiates itself through a government-focused, cost-effective approach, deep technical expertise, and a values-driven culture that emphasizes building long-term partnerships and strong customer trust. Its goal is to help federal agencies improve operational efficiency, security, and decision-making by solving difficult technical problems and delivering reliable, mission-critical software and systems.
Company Size
51-200
Company Stage
N/A
Total Funding
N/A
Headquarters
Reston, Virginia
Founded
2013
Get referred to AnaVation
See people who can refer or advise you
Simplify's Take
What believers are saying
- AnaVation earned 2026 Best Places to Work, supporting recruiting and retention.
- FBI ITSSS-2 and MDA SHIELD expand addressable task orders through 2034.
- Open 2026 hiring for security and litigation support signals ongoing demand.
What critics are saying
- FBI and MDA vehicles intensify competition from Leidos, Booz Allen, and SAIC.
- Award concentration on federal contracts exposes revenue to protest delays and recompetes.
- Without non-government diversification, AnaVation depends on a few agencies and contracting officers.
What makes AnaVation unique
- AnaVation won FBI ITSSS-2, an eight-year, $8B vehicle in 2024.
- AnaVation joined MDA SHIELD in January 2026, a $151B IDIQ pool.
- CMMC Level 2 positions AnaVation for controlled government cyber work.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Health Insurance
- Dental Insurance
- Vision Insurance
- Disability Insurance
- 401(k) Retirement Plan
- 401(k) Company Match
- Paid Vacation
- Paid Holidays
- Professional Development Budget
- Life Insurance