Senior Information Security Analyst DoS CSS

OneZero Solutions is an employee-centric company focused on supporting customers and missions through technically proficient cyber mission teams. The Senior Information Security Analyst serves as the ISSO of record for a portfolio of Moderate-baseline consular systems, managing authorization packages, continuous monitoring, RMF cycles, remediation, and day-to-day direction of Information Assurance Analysts.

Responsibilities:

• Serve as ISSO of record and primary cybersecurity point of contact for an assigned portfolio of approximately 6–8 Moderate-baseline systems
• Execute RMF Steps 1–3 for assigned systems: categorization with CIA justification, baseline and overlay selection, tailoring rationale, Inherited Controls Matrix, SSP and Security Control Implementation Statements, Evidence Index, and Implementation Readiness Review
• Develop and maintain PIA, DIRA, ISA/MOU, Security Assessment Plan, POA&M, SIA, system inventory, IRP, CP/ISCP, CP Test report, and CMP for assigned systems; ensure CMPs are delivered into the GRC tool
• Set up and support Security Control Review Meetings and demos, collect and validate artifacts requested by the SCA, attend A&A Findings Meetings, and support remediation validation(RMF Step 4)
• Maintain authoritative POA&Ms in theGRC tool (monthlyupdates and within 5 business days of status changes) with realistic milestones, accurate risk levels, and closure evidence attached (RMF Step 6)
• Review iPost scores weekly; coordinate remediation with system and application teams; track and report findings open more than 30 days
• Review vulnerability, KEV, CVE, and STIG results within 5 business days; drive critical and high remediation within Department and BOD timelines; document in POA&Ms
• Conduct annual Contingency Plan tests and Annual Control Assessments; document results and lessons learned; update CP, ISCP, IRP, and CMP as needed
• Perform Security Impact Analyses for hardware, software, patch, and configuration changes; participate in CCB/ECM; contribute to the Quarterly Configuration and Change Impact Summary
• Coordinate incident reporting and documentation with the SOC and system owners; reflect outcomes in risk posture and POA&Ms
• Direct system-specific security operations contractors to obtain evidence and implement remediation; validate completion before POA&M closure
• Support audits and data calls (OIG, GAO, CISA, HVA, BOD, OMB, CDM) and maintain the Audit and Data Call Response Package for assigned systems
• Provide day-to-day direction and quality review for Information Assurance Analysts supporting the portfolio

Requirements:

• • Seven (7)+ years of information security experience, including four (4)+ years as an ISSO or in an equivalent A&A role for federal information systems
• • Demonstrated experience authoring SSPs, POA&Ms, contingency plans, and supporting authorization packages under NIST SP 800-37 / SP 800-53 Rev. 5
• • One of: CISSP, CISM, CGRC/CAP, or CISA (DoD 8140/8570 IAM Level II or higher)
• • Active, final SECRET security clearance; U.S. citizenship
• • Experience with an enterprise GRC tool and with interpreting vulnerability scan results
• • Strong technical writing and stakeholder coordination skills
• • Department of State (DT/CA/CST) experience; ArchAngel and iPost proficiency
• • Experience with cloud or hybrid authorization boundaries and FedRAMP inheritance
• • Experience conducting NIST SP 800-34 contingency plan tests and NIST SP 800-63 Digital Identity Risk Assessments