Senior ISSO

Senior Information Systems Security Officer (ISSO)

Job Description
Prism is seeking a Senior Information Systems Security Officer (ISSO) to support a critical enterprise client. This senior-level role is responsible for ensuring the security and compliance of organizational information systems by implementing and managing security controls aligned with industry cybersecurity frameworks, including the NIST Risk Management Framework (RMF) and NIST SP 800-53.
This is an excellent opportunity for an experienced cybersecurity professional to contribute to the secure provisioning, authorization, and ongoing monitoring of systems across both on-premise and cloud environments. The ISSO will collaborate with Information System Security & Privacy Officers (ISSPOs), system owners, engineers, and governance teams to maintain the confidentiality, integrity, and availability of critical enterprise systems.
Responsibilities:

• Develop, implement, and maintain IT security controls in accordance with NIST SP 800-53, RMF, and organizational security policies.
• Support the preparation, review, and submission of Security Authorization packages, including the System Security Plan (SSP), Security Assessment Report (SAR), and Plan of Action and Milestones (POA&M).
• Coordinate and prepare systems for Security Control Assessments (SCA), ensuring all artifacts are accurate and complete.
• Conduct and document Security Impact Analyses (SIAs) for changes to hardware, software, cloud infrastructure, or connectivity.
• Participate in configuration and change control processes, ensuring secure baselines are maintained and reflected in documentation.
• Assist in system categorization and validate asset inventories to ensure appropriate control baselines are applied.
• Assess control implementation effectiveness and identify deficiencies for remediation or risk acceptance.
• Document business justifications and mitigation strategies for risk acceptance proposals for Authorizing Officials.
• Support Continuous Monitoring by reviewing security alerts, system changes, and compliance evidence to ensure ongoing authorization.
• Contribute to the development, revision, and enforcement of security policies, procedures, and technical guidelines.
• Participate in internal IT governance processes, including exception handling, standards reviews, and control waivers.
• Support security awareness and training compliance for personnel with system access.
• Monitor evolving threats and recommend adaptive security controls in response to risk landscape changes.
• Prepare high-quality technical documentation, status reports, and risk briefings for internal and external stakeholders.

Qualifications
Requirements:

• Bachelor's degree and 9+ years of IT security or systems security engineering experience, or Master's degree with 7+ years of experience.
• Hands-on experience implementing and managing security controls in enterprise or highly regulated IT environments.
• Strong understanding of the NIST RMF, NIST SP 800-53, and industry-standard security policies including recent executive orders and mandates.
• Experience performing risk assessments, preparing ATO (Authorization to Operate) documentation, and tracking control deficiencies in POA&Ms.
• Working knowledge of cloud security (AWS, Azure, GCP) and hybrid environments.
• Familiarity with enterprise platforms such as Microsoft 365, Azure AD, Cisco, and Oracle.
• Proficient in network and system security concepts, including IDS/IPS, VPNs, encryption, secure baselining, and OS hardening.
• Experience supporting third-party security assessments or audits.
• Strong documentation, reporting, and communication skills, including the ability to convey complex technical issues to non-technical audiences.
• Proficient in Microsoft Office (Word, Excel, PowerPoint, SharePoint).

Preferred Qualifications:

• Current cybersecurity certification such as CISSP, CISM, or Security+.
• Experience with GRC (Governance, Risk, and Compliance) and SA&A (Security Assessment & Authorization) tools such as Archer, or similar platforms.
• Familiarity with cloud compliance requirements and privacy regulations.
• Knowledge of OWASP Top 10 and modern application security best practices.
• Understanding of adversary TTPs (Tactics, Techniques, and Procedures) and frameworks such as MITRE ATT&CK.
• Ability to work independently and manage priorities in a fast-paced, dynamic environment.

Background Check:

• All candidates must be eligible to successfully complete and maintain a comprehensive background check.

Hybrid Role:

• This hybrid role requires a minimum of three on-site days per week in Washington, DC.