Information System Security Officer Sr. (Cloud)

Everforth ECS Federal is seeking an experienced Information System Security Officer Sr. (Cloud) to support cybersecurity, risk management, and Security Assessment and Authorization activities for federal information systems in cleared law enforcement and national security environments.

Please Note: This position is contingent upon contract award.

The successful candidate will provide senior-level ISSO support for complex, mission-critical systems, with an emphasis on cloud security, RMF execution, security documentation, continuous monitoring, vulnerability management, audit readiness, and authorization support. This role will work closely with system owners, security managers, security engineers, cloud teams, technical stakeholders, and government leadership to help systems obtain and maintain compliant authorizations.

Responsibilities Include:

• Responsible for executing the Security Assessment and Authorization program for assigned federal information systems.
• Provide full system lifecycle ISSO support for federal information systems to obtain and maintain compliant authorizations.
• Prepare, review, update, and maintain security authorization documentation and RMF artifacts in accordance with federal standards and customer policies.
• Develop and maintain System Security Plans, control implementation descriptions, Plans of Action and Milestones, risk assessments, contingency planning artifacts, data flow diagrams, network diagrams, hardware/software inventories, and assessment evidence.
• Support cloud security documentation and compliance activities for systems hosted in or connected to AWS, Azure, Google Cloud Platform, or other approved cloud environments.
• Review cloud security considerations such as control inheritance, shared responsibility, identity and access management, encryption, logging, monitoring, configuration management, and secure cloud architecture.
• Conduct risk assessments, document security findings, develop POA&Ms, and ensure remediation actions are tracked to closure.
• Keep system documentation, inventories, diagrams, and authorization artifacts current in support of audits, vulnerability reporting, emergency directives, and continuous monitoring requirements.
• Coordinate proactively with system owners, security managers, security engineers, technical teams, cloud teams, and authorizing officials to avoid authorization delays or lapses.
• Support vulnerability and patch management activities by reviewing scan results, documenting findings, coordinating remediation status, and helping ensure corrective actions are completed within required timelines.
• Support annual control assessments, compliance reviews, audit readiness activities, continuity planning, resiliency documentation, and security documentation reviews.
• Prepare clear, accurate, and defensible responses for government reviewers, auditors, security managers, and authorizing officials.
• Provide technical input and ISSO support for post-incident recovery activities, as needed, including documentation updates, remediation tracking, and return-to-service security considerations.
• Mentor junior and mid-level cybersecurity personnel by providing technical guidance, reviewing work products, sharing RMF and cloud security best practices, and helping improve team execution quality.
• Contribute to portfolio and program improvements by identifying recurring risks, documentation gaps, cloud security concerns, process inefficiencies, automation opportunities, and lessons learned.
• Identify and recommend tools, workflows, templates, and process improvements that improve speed, quality, consistency, and audit readiness across authorization and continuous monitoring activities.
• Track, report, and communicate security risks, compliance status, remediation progress, documentation quality issues, and improvement recommendations to program leadership and government stakeholders.
• Maintain current knowledge of NIST RMF, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FISMA, CNSS, DOJ, IC, FedRAMP, and other applicable federal cybersecurity and cloud security guidance.