Information System Security Officer / RMF Analyst - Active Top Secret

Information System Security Officer (ISSO) / RMF Analyst – Active Top Secret Required

Location: Washington, DC / National Capital Region
Work Arrangement: On-site
Clearance: Active Top Secret required; must be eligible for SCI access
Position Type: Full-Time

Position Overview

We are seeking an experienced Information System Security Officer (ISSO) / RMF Analyst to support a mission-critical classified Department of the Treasury information technology environment in the Washington, DC area.

The ISSO will support cybersecurity compliance, Risk Management Framework (RMF), system authorization, vulnerability management, security documentation, and the ongoing security posture of classified information systems.

This is a hands-on cybersecurity compliance position requiring someone who can independently develop and maintain security documentation, work with technical teams to resolve security findings, and communicate effectively with Government cybersecurity leadership.

TFIN supports classified intelligence capabilities and operates in physical and cloud environments subject to FISMA, NIST 800-53, CNSS 1253, ICD 503, Treasury security requirements, and DISA STIGs.

Key Responsibilities

The ISSO will:

• Support the NIST Risk Management Framework (RMF) and system Assessment & Authorization activities.
• Develop, maintain, and update System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), risk documentation, security procedures, and related authorization artifacts.
• Support development and completion of system authorization/ATO packages, including the ability to help build an authorization package from initial development through authorization.
• Maintain and track system-level POA&Ms and support broader program-level POA&M activities.
• Review vulnerability scan results from tools such as ACAS/Nessus and coordinate remediation of identified vulnerabilities.
• Track and report DISA STIG implementation and compliance.
• Assess system changes and security impacts and work with technical teams to identify and remediate security weaknesses.
• Support FISMA, NIST, CNSS, Treasury, and other applicable cybersecurity compliance requirements.
• Support security-related audits, inspections, assessments, and requests.
• Work with Security Control Assessors and other cybersecurity personnel supporting system authorization activities.
• Support security incident and data-spillage reporting, incident documentation, exercises, and after-action reporting as required.
• Respond to cybersecurity questions and findings originating from SOC and other security organizations.
• Use Governance, Risk, and Compliance tools such as Xacta, eMASS, ServiceNow, or similar GRC platforms.
• Create and maintain cybersecurity SOPs, reports, spreadsheets, trackers, presentations, and other documentation.
• Produce clear, professional documentation using Microsoft Word, Excel, PowerPoint, and related Microsoft Office tools.
• Provide status and metrics to Government and contractor program leadership.
• Participate in periodic after-hours or weekend support when required for security incidents, maintenance, exercises, or other mission requirements.

The underlying PWS specifically calls for the ISSO to define, create, and maintain C&A documentation; manage vulnerabilities and POA support audits; assess security requests; and maintain the operational security posture.

Required Qualifications

• Active final Top Secret security clearance.
• Must be eligible for SCI access.
• Practical experience supporting RMF and Assessment & Authorization (A&A) activities for Federal or DoD information systems.
• Experience developing and maintaining cybersecurity authorization documentation such as:
• • System Security Plans (SSPs)
  • POA&Ms
  • Risk assessments / risk acceptance documentation
  • Security procedures and SOPs
  • Authorization/A&A artifacts
• Demonstrated experience supporting or completing an ATO/RMF authorization package.
• Experience reviewing vulnerability scan results and tracking remediation using tools such as ACAS, Nessus, or equivalent.
• Working knowledge of NIST 800-53 security controls and Federal cybersecurity requirements.
• Experience with DISA STIGs and security compliance.
• Strong technical writing and documentation skills.
• Strong proficiency with Microsoft Office, particularly Word and Excel, including the ability to create professional documents and trackers from scratch.
• Ability to communicate cybersecurity risks and requirements effectively with engineers, system administrators, leadership, and Government customers.
• Ability to work independently in a classified, mission-focused environment.
• Ability to work on-site in the Washington, DC/NCR area.

Desired Qualifications

• Previous ISSO experience supporting a Federal, DoD, Intelligence Community, or other classified environment.
• Experience with Xacta, eMASS, ServiceNow GRC, or comparable governance/risk/compliance platforms.
• Experience working directly with Security Control Assessors, ISSMs, system owners, and technical engineering teams.
• Familiarity with FISMA, CNSS 1253, ICD 503, and Federal security authorization processes.
• Experience supporting classified systems operating in hybrid on-premises/cloud environments.
• Security-related certification such as Security , CAP/CGRC, CISSP, CASP /SecurityX, or equivalent.

Security & Work Environment

This position supports a classified information system and requires work within secured Government facilities. The TFIN environment supports classified capabilities and operates under stringent Federal and Intelligence Community cybersecurity requirements.

Some after-hours or weekend support may be required for security incidents, exercises, maintenance, or mission requirements. Task 2A expressly provides for such support.

Tenacity Solutions, LLC is a Certified Service-Disabled Veteran-Owned Small Business (SDVOSB) and SBA-certified 8(a) firm delivering high-impact solutions to federal and state government clients. We operate in complex, mission-critical environments and provide reliable, data-informed execution that keeps operations running and improving. From secure IT environments and network operations to data-driven decision support and critical operational services, Tenacity brings the discipline, speed, and precision required to perform in high-pressure settings. Whether enabling mission continuity, improving system performance, or streamlining workforce operations, our focus is always on outcomes that matter, executed with accountability, adaptability, and purpose.