Information Systems Security Officer (ISSO), Mid

Quantum Sky is searching for an Information Systems Security Officer (ISSO), Mid to support a federal customer in Washington, DC. We are looking for a highly organized, proactive, and customer-focused cybersecurity professional who excels at building trusted relationships, communicating with both technical and executive stakeholders, and independently driving complex initiatives to successful completion.

The ideal candidate thrives in a fast-paced environment, embraces ownership and accountability, and consistently delivers high-quality work while balancing customer needs with federal security and privacy requirements. In this role, you will serve as a trusted advisor to government customers while leading information security, privacy, and Governance, Risk, and Compliance (GRC) activities to ensure federal systems remain secure, compliant, and mission-ready.

Responsibilities:

• Lead and support information system security responsibilities throughout the Risk Management Framework (RMF) lifecycle, including Authorization to Operate (ATO), continuous monitoring, and integration of security, privacy, and legal requirements.
• Develop, maintain, and present security authorization packages and supporting documentation in accordance with client requirements and NIST SP 800-53, including SSPPs, RARs, SAPs, SARs, POA&Ms, contingency and incident response plans, SOPs, configuration management plans, STIG deviations, and related artifacts.
• Own security and privacy initiatives from planning through completion by proactively managing tasks, driving remediation efforts, validating corrective actions, and ensuring deliverables are completed accurately and on schedule.
• Perform security and privacy risk assessments, analyze vulnerability scan results, recommend risk-based solutions, and support continuous monitoring activities across applications, infrastructure, and databases.
• Serve as a trusted cybersecurity advisor to Contracting Officer Representatives (CORs), system owners, business stakeholders, and technical teams by communicating complex security and privacy requirements clearly, professionally, and with a customer-focused approach.
• Develop, coordinate, test, and maintain contingency planning, incident response, privacy, and continuity activities, including PTAs, PIAs, HVA support, privacy training, and privacy-by-design integration throughout the System Development Life Cycle (SDLC).
• Develop and maintain privacy policies, directives, SOPs, and operational guidance while ensuring compliance with applicable federal privacy laws, OMB guidance, NIST publications, CJIS Security Policy, and Legislative Branch requirements.
• Build strong cross-functional relationships while managing multiple concurrent priorities in a fast-paced environment, identifying process improvements, and maintaining exceptional attention to detail across all security and compliance activities.
• Coordinate with internal and external stakeholders to support audits, agency data calls, reporting requirements, asset inventories, and other compliance initiatives.

Qualifications


Required:

• Bachelor's degree and at least four (4) years of relevant experience supporting cybersecurity, information assurance, or Governance, Risk, and Compliance (GRC) activities within the NIST Risk Management Framework (RMF) lifecycle.
  • High school diploma with 8 years of experience in Functional Responsibility area may be substituted for a Bachelor’s Degree
  • PMP, ISO 27001, or CISM certifications equate to 3 years of experience in Functional Responsibility each
  • ITIL, CISSP, or other relevant IT management certifications equate to 2 years of general experience each
• Knowledge of and proficiency in federal government privacy programs, including the Privacy Act of 1974, the E-Government Act of 2002, and related federal privacy laws and regulations.
• Demonstrated understanding of information privacy principles, including information access, release of information, and implementation of privacy controls for electronic and non-electronic information.
• Experience supporting Cybersecurity Awareness Training (CSAT) privacy initiatives, including training development, effectiveness evaluation, and privacy awareness programs.
• Experience with HR privacy and behavioral privacy considerations related to workforce data and monitoring activities.
• Thorough knowledge of FISMA, NIST RMF, Security and Privacy Assessment & Authorization (SPA&A), NIST publications, OMB circulars and memoranda, and CNSS guidance.
• Strong written and verbal communication skills with experience developing technical documentation, presenting complex security and privacy concepts to technical and non-technical audiences, and building trusted relationships with Contracting Officer Representatives (CORs), government leadership, and cross-functional stakeholders.
• Demonstrated ability to lead end-to-end security and compliance initiatives by proactively managing competing priorities, driving deliverables to completion, and exercising sound judgment in a fast-paced, customer-focused environment.
• Highly organized, detail-oriented, and self-motivated with strong analytical and critical thinking skills, a commitment to producing audit-ready documentation, and the ability to identify process improvements while balancing customer service with regulatory compliance.

Desired:

• CRISC, CAP, CISSP, or equivalent
• Experience with FedRAMP and cloud service providers
• Experience with CSAM and ServiceNow
• Experience with vulnerability assessment tools such as Nessus and/or Qualys
• Policy writing background is highly preferred

Clearance:

• US Citizen with Public Trust eligibility required

Location:

• On-site in DC, minimal remote flexibility