ISSO Senior Analyst

<p><b>Context:</b> The ISSO Senior Analyst role supports federal systems across the NIST RMF lifecycle by owning authorization workstreams and delivering security control assessment documentation.</p><br /><h3>Responsibilities</h3><br /><ul><br /><li>Own RMF delivery workstream for assigned systems by maintaining security posture documentation and supporting system owners and government ISSMs throughout the authorization lifecycle.</li><br /><li>Use NIST SP 800-53A assessment procedures alongside NIST SP 800-53 controls and applicable overlays to select examination, interview, and test methods, judge evidence sufficiency, and document objective results with traceability from implementation statements to architecture and evidence.</li><br /><li>Develop and maintain core authorization artifacts, including System Security Plans, Security Assessment Plans, Security Assessment Reports, control implementation statements, and supporting appendices.</li><br /><li>Perform analysis for information types and impact analysis, including FIPS 199 categorization and NIST SP 800-60 mapping; identify stakeholders and roles; document authorization boundary rationale and risk context.</li><br /><li>Define and document system boundary information and authorization boundaries, component inventories, data flows, interconnections, and inherited or shared controls.</li><br /><li>Determine control baseline selection, tailoring, overlays, scoping, parameter assignment, compensating controls, and common-control inheritance based on system architecture and hosting model.</li><br /><li>Draft findings and create POA&amp;M items linking condition and evidence to control requirements, including threat and vulnerability context, likelihood, impact, recommended action, and acceptance criteria.</li><br /><li>Manage POA&amp;M execution for assigned systems, including remediation tracking, evidence validation, closure packages, and deviation or risk acceptance documentation.</li><br /><li>Execute NIST 800-137 continuous monitoring and event-driven monitoring activities, including control review cycles, vulnerability management reporting, configuration compliance tracking, and monthly reporting deliverables.</li><br /><li>Conduct security impact analyses for proposed changes and document results for system owner review.</li><br /><li>Review scan results and STIG or CIS benchmark results; validate findings, distinguish false positives, and connect technical evidence to NIST controls.</li><br /><li>Maintain accurate system records and authorization artifacts in governance, risk, and compliance tools such as eMASS, JCAM, and Xacta.</li><br /><li>Facilitate evidence-gathering sessions and control interviews with system owners, engineers, and application teams.</li><br /><li>Coordinate assigned workstreams, review Analyst deliverables for quality and consistency, provide task-level guidance, manage dependencies, and escalates risk.</li><br /><li>Track delivery commitments, monitor schedule and quality risks, and escalates issues to engagement leadership.</li><br /><li>Provide day-to-day coaching to Analysts on assessment procedures, evidence expectations, and documentation standards.</li><br /><li>Review Analyst work products for accuracy, completeness, and consistency before submission; provide specific, actionable feedback.</li><br /><li>Use knowledge of cybersecurity industry trends to identify engagement and client service issues and communicate through written correspondence and verbal presentations.</li><br /><li>Stay current on cybersecurity industry trends relevant to delivered services.</li><br /></ul><br /><h3>Requirements</h3><br /><ul><br /><li><b>Bachelor’s degree</b> in cybersecurity, information technology, information systems, computer science, engineering, business, or related field.</li><br /><li><b>Minimum 3 years</b> of related work experience in cybersecurity, technology risk, compliance, or information technology, including hands-on federal RMF support.</li><br /><li>Ability to obtain and maintain a <b>secret level clearance</b>.</li><br /><li>Comfortable working in a <b>hybrid</b> setting.</li><br /><li>Experience developing or maintaining RMF documentation, collecting and organizing control evidence, supporting assessment readiness, tracking POA&amp;Ms, or executing continuous monitoring activities.</li><br /><li>Experience in one or more areas such as:<br /><ul><br /><li>Federal authorization package development and maintenance.</li><br /><li>NIST SP 800-53 control implementation statements and evidence mapping.</li><br /><li>Security control assessment preparation and response coordination.</li><br /><li>POA&amp;M tracking, remediation support, or continuous monitoring reporting.</li><br /><li>Federal governance, risk, and compliance tools such as eMASS, JCAM, CSAM, or Xacta.</li><br /><li>Technical security artifacts such as network diagrams, inventories, vulnerability scans, STIG or CIS benchmark results, change records, or configuration data.</li><br /></ul><br /></li><br /><li>Flexibility to <b>travel up to 20%</b>.</li><br /></ul><br /><h3>Technologies</h3><br /><ul><br /><li>NIST CSF</li><br /><li>NIST 800-53r5</li><br /><li>NIST 800-37r2</li><br /><li>NIST SP 800-53A</li><br /><li>NIST SP 800-53</li><br /><li>NIST SP 800-60</li><br /><li>NIST SP 800-30</li><br /><li>NIST SP 800-137</li><br /><li>FIPS 199</li><br /><li>FISMA</li><br /><li>eMASS</li><br /><li>JCAM</li><br /><li>Xacta</li><br /><li>CSAM</li><br /><li>STIG</li><br /><li>CIS</li><br /><li>FISMA and relevant agency-specific policies</li><br /></ul><br /><h3>Ideally, You’ll Also Have</h3><br /><ul><br /><li>CISSP, CISM, CISA, CGRC, CIPT, CIPM, CIPP, CRISC, or other relevant certification.</li><br /><li>Prior experience supporting a federal agency, consulting engagement, service delivery center, or managed service.</li><br /></ul><br /><h3>Skills and Attributes for Success</h3><br /><ul><br /><li>Applied knowledge of federal security frameworks and standards including NIST SP 800-37, 800-53/53A, 800-60, 800-30, 800-137, FIPS 199/200, FISMA, and relevant agency-specific policies.</li><br /><li>Applied knowledge of the NIST Risk Management Framework and security control assessment methodology.</li><br /><li>Ability to analyze technical information and translate it into clear control documentation.</li><br /><li>Ability to manage multiple systems or workstreams concurrently.</li><br /><li>Ability to review work products for quality and consistency.</li><br /><li>Clear communication with technical stakeholders and engagement leadership.</li><br /></ul><br /><p><b>Location:</b> San Antonio, TX (hybrid)</p><br />#J-18808-Ljbffr