Information Systems Security Officer (ISSO) - GSA Contract

About the role

Global InfoTek is seeking an Information Systems Security Officer (ISSO) to protect the confidentiality, integrity and availability of critical federal and defense systems supporting a General Services Administration (GSA) contract. The ISSO navigates the Risk Management Framework (RMF) lifecycle through continuous monitoring and ensures compliance with federal mandates. The position is based in Reston, VA, requires a Secret clearance and US citizenship, and pays $169,000-$190,000 per year depending on experience and qualifications.

Key responsibilities

• Navigate the 6-step RMF lifecycle in line with FISMA requirements.
• Run daily, weekly and monthly continuous monitoring, including audit log reviews and account management audits.
• Work with system administrators to apply security hardening guidelines such as DISA STIGs and CIS Benchmarks, and track vulnerability scan remediation.
• Maintain System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms).
• Gather and track evidence of control compliance for internal and external audits.
• Maintain records in GRC systems such as eMASS, Xacta, CSAM or Archer.
• Report security incidents and unauthorized activity immediately to the ISSM and incident response teams.

Required profile

• 7-10 years of experience; education may be considered in place of the degree requirement.
• Bachelor's degree, master's preferred.
• Professional experience in information assurance, cybersecurity compliance or systems administration.
• Deep understanding of the RMF (NIST 800-37) and NIST 800-53 controls, and familiarity with agency-specific overlays such as CNSSI 1253, DHS 4300A or DoD SRGs.
• Demonstrated hands-on experience with Agile delivery models (Scrum, Kanban, SAFe) and a DevSecOps framework.
• Preferred: DoD 8140/8570 IAM/IAT Level II certification (Security+ CE, CAP/CGRC, CySA+).

Required skills

• Vulnerability scanning and auditing tools such as Tenable/Nessus/ACAS, Qualys, Splunk.
• Experience working alongside DevSecOps and IT operations teams.
• Familiarity with zero-trust network principles.