Note: The job is a remote job and is open to candidates in USA. Xcelerate Solutions is seeking an Information System Security Officer (ISSO) / RMF Cybersecurity Analyst to ensure the security posture, compliance, and continuous monitoring of secure enterprise IT systems. The role guides systems through the federal Risk Management Framework lifecycle, maintains authorization packages and security controls, coordinates vulnerability management, and advises technical and government stakeholders.
Responsibilities
- Lead the system categorization, security control selection, implementation, assessment, and continuous monitoring processes across the RMF lifecycle
- Develop, update, and maintain comprehensive Security Authorization Packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plan of Action and Milestones (POA&Ms), and continuous monitoring plans
- Utilise government systems of record (e.g., Enterprise Mission Assurance Support Service - eMASS) to document and track compliance packages
- Coordinate and conduct regular vulnerability scans using automated tools (e.g., ACAS, Nessus, SCAP Compliance Checker)
- Analyze scan results, coordinate with technical teams to remediate vulnerabilities, and document necessary exceptions or POA&Ms
- Review Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) to ensure secure system configurations
- Monitor and assess security controls on an ongoing basis to ensure they remain effective over time in a dynamic operational environment
- Assist with the identification, investigation, and reporting of security incidents or anomalies in accordance with established reporting procedures
- Ensure log management, system auditing, and boundary protections are maintained in compliance with federal guidelines
- Act as the primary cybersecurity advisor to technical development, systems engineering, and management teams
- Ensure that new software features, infrastructure changes, and system updates are designed and implemented with security-by-design principles
- Support the planning and execution of security control assessments (SCAs) conducted by external assessment teams
Skills
- * **Education:** Bachelor's degree in Cybersecurity, Information Assurance, Computer Science, Information Technology, or a related field (equivalent professional experience may be considered)
- + Minimum of 5+ years of experience in cybersecurity, information assurance, or IT compliance
- + 3+ years of direct, hands-on experience guiding systems through the RMF process (Steps 1 through 7) to successful ATO determinations
- + Deep working knowledge of NIST SP 800-37, NIST SP 800-53, and CNSSI 1253
- + Direct experience using automated vulnerability assessment tools (e.g., Nessus, ACAS, SCC)
- + Proven experience managing and navigating security control databases (such as eMASS)
- + Solid understanding of operating system security configurations (Windows, Linux) and network security architectures
- + Strong technical writing skills with demonstrated ability to produce clear, structured compliance documentation
- + Excellent communication and interpersonal skills, with the ability to bridge the gap between technical teams and authorizing officials
- Active **DoD 8570.01-M / DoD 8140** Information Assurance Management (IAM) Level II certification (or higher)
- * **CompTIA Security+ CE** (acceptable depending on IAM/IAT alignment)
- * Certified Information Security Manager (CISM)
- * Certified Information Systems Security Professional (CISSP)
- * GIAC Security Leadership (GSLC)
- * Work Status Allowable: U.S. citizenship
- * Minimum Clearance to Start: Public Trust or Favorably Adjudicated Secret Clearance
- * Experience with cloud security compliance models (e.g., FedRAMP, AWS GovCloud, Azure Government)
- * Familiarity with secure software development principles, DevSecOps pipelines, and container security (e.g., Docker, Kubernetes)
- * Experience implementing Section 508 accessibility standards within cybersecurity practices
- * Experience supporting defense contract execution or secure federal program architectures
- * **Certified Authorization Professional (CAP / CGRC)** (highly preferred)
Benefits
- Growth and development opportunities that contribute to individual and company growth
- Inclusion on the Washington Business Journal’s “50 Best Places to Work” list
- “Great Place to Work” certified company
Company Overview