Lead Information System Security Officer (ISSO)

About This Role
Devis is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.

About This Role
As Lead ISSO, you will manage day-to-day delivery of all ISSO support services and serve as the primary technical interface with the government Information System Security Manager, the CISO, the Authorizing Official and designated representatives, System Owners, and other federal cybersecurity stakeholders. This is a hands-on leadership role rather than a purely administrative one. You will work directly in the agency’s compliance platform, chair quality reviews of authorization artifacts before they reach the government, and carry the technical credibility to defend a risk position in front of federal decision-makers. 

What You’ll Do
Own Technical Execution

• Direct ISSO activities across the full compliance lifecycle: program governance, Risk Management Framework and authorization support, continuous monitoring, vulnerability and POA&M management, security documentation, security impact analysis and change coordination, incident response coordination, and audit and assessment support
• Oversee development, quality control, and submission of authorization packages in CSAM
• Chair internal quality reviews of every deliverable before it goes to the government
• Maintain personal hands-on proficiency across CSAM, ServiceNow, Splunk, and enterprise vulnerability scanning platforms

Lead the Government Relationship

• Serve as the primary technical interface with the government ISSM, CISO, Authorizing Official and designated representatives, System Owners, and Common Control Providers
• Represent the team in agency governance forums including the Enterprise Review Board, Change Control Board, Cybersecurity Steering Committee, Risk Management Working Group, and Privacy Working Group
• Prepare and present authorization decision briefings to federal leadership
• Escalate risks and issues to government leadership with a recommended course of action attached

Run the Program

• Maintain the risk and issue register and drive items to documented closure
• Produce weekly activity reports, monthly program status reports, and quarterly executive review materials
• Track and report service-level and key-performance-indicator results across every work area
• Coordinate with corporate program management on staffing, reporting, and invoicing

Hold the Line on Service Levels

• Meet rapid-response commitments, including four-hour notification on known exploited vulnerabilities, one-business-day triage of critical findings, and one-hour incident acknowledgment during core hours
• Monitor first-time acceptance rates on deliverables and drive corrective action on any nonconformance
• Keep records audit-ready between audits, so evidence can be produced without a scramble

What We’re Looking For
Required Qualifications
Education & Experience

• Bachelor’s degree in cybersecurity, computer science, information systems, or a related technical discipline
• Minimum 10 years of cybersecurity experience
• At least 5 years in ISSO, ISSM, or Risk Management Framework-centric roles supporting federal information systems
• Demonstrated experience leading RMF authorization efforts under NIST SP 800-37 Revision 2, including System Security Plans, security assessment plans and reports, and POA&M lifecycle management
• Experience presenting to and coordinating with federal governance bodies and authorizing officials

Required Certifications

• CISSP or CISM, or a comparable advanced security certification

Technical Skills

• Hands-on experience with a federal governance, risk, and compliance platform. CSAM strongly preferred; eMASS, ArchAngel, or a comparable platform considered where you can demonstrate the ability to transition to CSAM
• Working proficiency with ServiceNow, Splunk, and an enterprise vulnerability scanner such as Tenable Nessus or Qualys
• Working knowledge of NIST SP 800-53, NIST SP 800-137, FIPS 199, and CISA Binding Operational Directive requirements including the Known Exploited Vulnerabilities catalog
• Federal-quality technical writing that an authorizing official or independent assessor can rely on without follow-up

Leadership Capabilities

• Track record of directing technical staff and holding a team to measurable service levels
• Ability to translate technical risk into terms federal executives can act on
• Sound judgment about the boundary between contractor recommendation and government decision authority

Preferred Qualifications

• FedRAMP inherited-control documentation experience, including Customer and Shared Responsibility Matrix reconciliation
• Microsoft Azure Government and Microsoft 365 GCC/GCC High experience
• Zero Trust architecture experience
• Privacy documentation experience, including Privacy Threshold Analyses and Privacy Impact Assessments
• Prior experience supporting a small federal agency or a CISO organization
• Current or recent Tier 4 High-Risk Public Trust adjudication, or higher

Performance Expectations
Success in this role means:

• Authorization artifacts accepted by the government on first submission
• Service-level and key-performance-indicator targets met across every work area
• Federal stakeholders able to make risk decisions without having to come back for more information
• A portfolio that stays audit-ready between audits

Special Requirements

• Based in the Washington, DC metropolitan area. This position requires regular in-person presence at DFC headquarters at 1100 New York Avenue NW for governance forums, authorization briefings, and audit and assessment activity, with remote work between those commitments.
• Authorization to work in U.S. without restriction.
• Must be eligible for and able to obtain a Tier 4 High-Risk Public Trust background investigation. Adjudication must be complete before privileged access to enterprise security tools or authorization repositories is granted.
• Must obtain and maintain an agency-issued PIV card.
• Must complete agency cybersecurity, privacy, records management, insider threat, and applicable role-based training on entry and annually thereafter.
• Availability during core business hours, 7:00 a.m. to 6:00 p.m. Eastern, Monday through Friday, excluding federal holidays, and participation in a shared on-call rotation for off-hours incident acknowledgment.

Compensation & Benefits

• $137,000.00 - $147,000.00 salary commensurate with experience and qualifications.
• This position is contingent upon contract award.

Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.