Responsibilities

Owns and maintains the authorization package and its body of evidence (BoE), including the SSP, control statement responses, and supporting artifacts, so that documentation reflects the current state of the system. eMASS is the system of record for the BoE and POA&Ms in this role.
Executes the package transition from NIST SP 800-53 Rev 4 to Rev 5 in coordination with the ISSM, using artifacts demonstrating compliance provided by security engineers and engineering development teams
Develops and maintains interconnection and boundary documentation, including ISAs and related agreements
Owns POA&M entries and milestone tracking, coordinating with security engineers and development teams on remediation artifacts and status
Prepares ConMon documentation and reporting on schedule and ensures findings are accurately captured in the package
Maintains the SBOM and component version representation in the package, and validates components against CVE data and mitigation guidance. Where a component carries a vulnerability, identifies the required remediation (for example, moving to a fixed version or above) and communicates it to the owning team. Where a compensating control is proposed instead, participates in the architectural plan and in obtaining AO and government customer buy-in. The role identifies vulnerabilities and required mitigations; it does not choose between alternative libraries or products.
Participates in the CCB, documenting the authorization impact of proposed changes and keeping the package aligned with approved changes, including filling in for the project ISSM on the unclassified system when the ISSM is unavailable. Contractor ISSOs and ISSMs do not accept new risk. They determine whether a proposal aligns with the current risk posture and refer anything outside it to the appropriate government authority.
Coordinates with security engineers for technical evidence, with development teams across the platform for artifacts, and with SCAs, AO staff, and government counterparts on documentation requests and findings
Drafts risk acceptance and deviation documentation when assigned by the ISSM, for ISSM review before submission
Identifies project-specific security training and awareness gaps not covered by customer or company guidance, in coordination with the ISSM
Supports security authorization activities in compliance with RMF, DoDI 8510.01, and related DoD processes
Provides surge support and backfill for ISSOs of other environments, including leave coverage, as clearance and access allow. This is a longer-term expectation; initial duties are limited to the unclassified (CUI) system.

Qualification

Current DoD 8570Working knowledge of RMFExperience maintaining the BoEExperience mentoring junior teammatesLocation and Clearance

Required

U.S. citizen able to obtain and maintain a TS/SCI clearance with CI polygraph, as longer-term duties include cross-environment coverage
Current DoD 8570.01-M IAM Level II or III certification. This program is currently bound by 8570 certification requirements and will transition to DoD 8140 qualification once the applicable 8140 certification list is approved.
5 or more years of relevant experience developing and maintaining RMF authorization packages (7 or more preferred)
Working knowledge of RMF, NIST SP 800-37, NIST SP 800-53 (Rev 4 and Rev 5), NIST SP 800-53B, NIST SP 800-60, and DoDI 8510.01
Experience maintaining the BoE, control statements, and POA&Ms in eMASS
Experience writing or maintaining ISAs or other interconnection agreements (NIST SP 800-47 Rev 1)
Understanding of network flows and architecture, especially cloud (Azure and AWS), on-premises, and hybrid environments, and the complexities each introduces
Ability to context switch across multiple teams with differing goals and priorities, and to consolidate them into one coherent authorization package for the whole platform
Familiarity with auditing and control assessments, including working with SCAs
Familiarity with the SDLC and with working across multiple Agile or DevSecOps development teams
Knowledge of government security requirements for unclassified and CUI systems
Strong written and verbal communication skills. Documentation in this environment is produced with limited AI/LLM support, because many LLMs are not approved to process CUI or above, so candidates must write clear, accurate technical documentation on their own.

Preferred

Active TS/SCI clearance with CI polygraph
Experience migrating an authorization package from NIST SP 800-53 Rev 4 to Rev 5
Experience taking a package from creation to full ATO
Experience with classified system authorization (for example CNSSI 1253 overlays)
Experience reading and interpreting vulnerability scan results to support CVE validation and POA&M entries
Experience mentoring junior teammates
Location and Clearance
This is a hybrid position with an expected 3-4 days onsite. Clarity Innovations strives to set consistent expectations and ensure a flexible and healthy work-life balance, but due to the position's nature and emergent customer needs, some weeks may exceed 3-4 days and others may require no onsite work. It will require a counterintelligence polygraph upon hiring if not already attained.

Principal Information System Security Officer at Clarityinnovates · LumiJobs

Principal Information System Security Officer

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Clarityinnovates

More roles at Clarityinnovates