• Conduct security control assessments of information systems using interview, examination, and testing methods • Verify compliance with established frameworks such as NIST SP 800-37, NIST SP 800-53, NIST SP 800-171, FISMA, and/or FedRAMP, depending on organizational requirements • Analyze system architectures, network diagrams, configuration settings, and policies to identify vulnerabilities and compliance gaps • Review vulnerability scanning results (e.g., Nessus, Qualys) and penetration testing reports to validate the implementation of technical controls • Document detailed testing results and draft sections of the Security Assessment Report (SAR), ensuring clear explanations of non-compliant findings • Present assessment findings and risk postures to Authorizing Officials (AO), system owners, and other stakeholders in clear, actionable terms • Assist system owners in the development of realistic Plans of Action and Milestones (POA&M) to remediate identified deficiencies • Collaborate with the Risk Management team to ensure assessment data accurately informs the organization’s continuous monitoring strategy • Stay current on emerging cyber threats, vulnerabilities, regulatory changes, and assessment techniques • Identify opportunities to automate assessment processes and integrate modern tooling into the assessment lifecycle • Participate in the development and refinement of enterprise information security policies, standards, and guidelines

• We are seeking a highly skilled and experienced Information Systems Security Officer (ISSO) Subject Matter Expert (SME) to join our team. • In this critical role, you will be ultimately responsible for the day-to-day cyber operations of assigned systems, ensuring strict adherence to the Risk Management Framework (RMF) and industry standards. • As a trusted advisor, you will collaborate closely with executive leadership—including the Authorizing Official (AO), System Owners, and the Chief Information Security Officer (CISO)—to mitigate risk and defend vital digital infrastructure.

• Manage overall platform security to meet/exceed stakeholder cybersecurity expectations • Design and implement security architectures, controls, and technologies for government systems • Lead vulnerability assessment, penetration testing support, and security engineering reviews • Develop and maintain security documentation (SSPs, POA&Ms, etc.) for ATO packages • Support Risk Management Framework (RMF) implementation and continuous monitoring programs • Implement Zero Trust, identity management, and endpoint security solutions • Respond to security incidents, conduct forensic analysis, and coordinate remediation • Provide security guidance to development and infrastructure teams

• executing the design, building, testing, and implementation of security systems across our environment • working closely with other members of the Information Security team to identify potential threats and vulnerabilities and develop strategies and solutions to mitigate these risks • securing the end-user device estate and the mobile platforms through which the enterprise increasingly operates • contributing to our overall information security strategy • define and evaluate security architecture for the end-user device estate • advise on mobility security • perform Security Architecture Reviews • deliver Security Architecture Consulting engagements with business partners • provide Risk Evidence Review on request • plan, design, build, and implement enterprise security architecture • evaluate security technologies and controls across the environment • identify and communicate current and emerging security threats and risks • help develop solutions that balance information security needs with the needs of the business • be fluent with AI concepts and incorporate AI into your daily workflows • create reusable security-architecture artifacts • support training and mentorship of more junior employees