WM-JD-003 · Key Personnel
Senior Information System Security Officer (ISSO)
RMF & FISMA Compliance
- Pay range
- $140,000 – $175,000 per year, based on experience, clearance, and certifications
- Employment type
- Full-time, exempt; contingent upon contract award
- Location
- Washington, DC metro area — on site at federal client locations in Washington, DC, Maryland and Northern Virginia, with hybrid days as the client permits
- Clearance / suitability
- U.S. citizenship required. Active Secret clearance required; Top Secret preferred. Civilian-agency work requires a Public Trust investigation.
- Reports to
- Jessica D. Miller, Chief Executive Officer
- Travel
- Up to 10% within the region
Position summary
The Senior ISSO is the second senior cybersecurity professional at Winston & Miller and lets the company staff more than one security contract at a time. You own the security authorization and continuous-monitoring lifecycle for assigned federal systems: build and maintain authorization packages, run control assessments against NIST SP 800-53, manage plans of action and milestones (POA&Ms), and keep systems compliant with FISMA and agency policy. You work alongside our founder, a former Navy Qualified Validator, and represent the company to agency CISOs and authorizing officials.
Key responsibilities
Assessment and authorization
- Lead Risk Management Framework (RMF) activities for assigned systems from categorization through authorization to operate (ATO), using NIST SP 800-37 and NIST SP 800-53 Rev. 5.
- Develop and maintain System Security Plans, security assessment reports, POA&Ms, contingency plans, and other authorization artifacts.
- Administer authorization packages in eMASS or the agency's GRC tool (such as CSAM or Xacta).
Continuous monitoring and vulnerability management
- Run continuous monitoring: review vulnerability scans (ACAS/Nessus or equivalent), STIG and configuration compliance, and audit logs.
- Track and burn down POA&M items with system owners; report status to the ISSM and authorizing official.
- Support incident response — isolate affected assets, collect data, perform initial investigation, and report findings.
Compliance, assessment, and Zero Trust
- Conduct control assessments and gap analyses against NIST SP 800-53, FISMA, the NIST Cybersecurity Framework 2.0, and the CISA Zero Trust Maturity Model.
- Prepare FISMA reporting and data calls; support audits and inspector general reviews.
- Write and update security policies, procedures, and role-based training.
Client leadership and growth
- Serve as the trusted security advisor to system owners, ISSMs, and authorizing officials.
- Contribute technical content and labor-category descriptions to proposals and RFI responses.
- Mentor junior analysts as the company grows.
Required qualifications
- Bachelor's degree in cybersecurity, information systems, computer science, or a related field; 4 additional years of directly relevant experience may substitute.
- At least 8 years of information security experience, including at least 5 years as an ISSO, ISSM, or security control assessor on federal systems.
- DoD 8140 / 8570 IAM or IAT Level II-qualifying certification, active (such as CompTIA Security+, CySA+, CASP+, CISSP, or CISM).
- Demonstrated experience taking federal systems through ATO under the RMF and NIST SP 800-53.
- Hands-on experience with eMASS, CSAM, Xacta, or a comparable GRC platform.
- Experience with vulnerability scanning results (ACAS/Nessus), STIGs, and POA&M management.
- Active Secret clearance and U.S. citizenship.
Preferred qualifications
- Active Top Secret clearance.
- CISSP, CISM, CASP+, or CAP / CGRC certification.
- Experience with Zero Trust architecture assessments or Security Operations Center (SOC) programs.
- Experience supporting federal civilian and Department of Defense systems.
- FedRAMP or cloud security authorization experience (AWS GovCloud or Azure Government).
- Military service.
What success looks like in your first 90 days
- Day 30: you know every assigned system's authorization status, POA&M backlog, and next milestone.
- Day 60: continuous-monitoring reporting runs on schedule and the oldest POA&M items have owners and dates.
- Day 90: at least one authorization package is ready for the authorizing official without rework.
Benefits and other compensation
Medical (PPO or HSA-eligible high-deductible plan), dental and vision coverage, with the company paying 90% of employee premiums and 70% of dependent premiums; a 401(k) with a 100% match on the first 4% of pay, vested immediately; company-paid life, AD&D, short-term and long-term disability insurance; 15 days of paid time off (unused PTO is paid out when you leave), 11 paid federal holidays and 1 floating holiday, separate paid sick and safe leave, paid parental and military leave; and $3,500 a year for training and certifications.
Health
- Medical coverage with a choice of a PPO plan or a high-deductible plan with a Health Savings Account (HSA)
- The company pays 90% of the premium for employee coverage and 70% for spouse and dependent coverage
- Company HSA contribution of $1,000 a year for single coverage or $2,000 for family coverage on the high-deductible plan
- Dental and vision coverage: the company pays 100% for employees and 50% for dependents
- Confidential Employee Assistance Program for you and your household
Pay beyond salary
- Performance bonuses
- Commission on new business you help win
- Equity participation for qualified team members who join as partners
- Referral bonuses when someone you refer is hired
Retirement
- 401(k) with pre-tax and Roth options
- Safe harbor match: 100% of the first 4% of pay you contribute, vested immediately
- Automatic enrollment at 6% of pay, rising 1% a year to 10%; you can change or stop contributions at any time
Insurance
- Life and AD&D insurance of 1× salary up to $200,000, company-paid
- Short-term disability: 60% of pay up to $1,500 a week, company-paid
- Long-term disability: 60% of pay up to $10,000 a month, company-paid
Time off
- 15 days of paid time off a year, available from January 1 and prorated in your first year; unused PTO is paid out when you leave
- 11 paid federal holidays and 1 floating holiday
- Paid sick and safe leave, separate from paid time off: 1 hour for every 30 hours worked, up to 56 hours a year, usable from your first day; up to 56 unused hours carry over
- Paid parental leave: the company tops up state paid-leave benefits to full pay for 6 weeks after a birth, adoption or foster placement
- Paid military leave: the company makes up the difference between military and regular pay for up to 15 working days a year of Guard or Reserve duty
- Paid bereavement leave of up to 5 days and full pay during jury duty
- Paid family and medical leave benefits through the District of Columbia Universal Paid Leave program and, from January 2028, Maryland's FAMLI program, based on where you work
Growth and work tools
- $3,500 a year for training, courses and certification exams
- The company pays required certification maintenance fees (for example ISC2, ISACA and CompTIA)
- Paid time for security clearance paperwork, interviews and reinvestigations
- $100 a month toward your phone and internet
- Up to $1,000 for home-office equipment in your first year
Other compensation. Performance bonuses; commission on new business you help win; equity participation for qualified team members who join as partners; and referral bonuses when someone you refer is hired. The company also pays a $100 monthly phone and internet stipend and up to $1,000 for home-office equipment in your first year.
Benefits begin on your first day of employment, which starts on contract award. Plan documents and the written bonus, commission and equity plans govern the details.
Work environment
Professional office environment at government and company sites. Regular use of a computer and standard office equipment for extended periods. Occasional local travel between client and company offices.
Contingent upon award
This position is contingent upon contract award. Winston & Miller is building its team for specific federal opportunities now in market research and solicitation. Selected candidates sign a letter of commitment that lets us name them in our proposal; employment begins on contract award and funding. We will tell you which opportunity your position supports and keep you informed as it progresses.
About Winston & Miller
Winston & Miller is a veteran-owned, woman-owned federal contractor based in the National Capital Region, serving Washington, DC and Prince George's County, Maryland. We get federal systems and programs to their goals and keep them there — Risk Management Framework (RMF) authorization, ISSO support, and disciplined program management for civilian and defense agencies. Our founder and CEO, Jessica D. Miller, is a U.S. Army veteran with 30 years of DoD information-assurance and program leadership. We are a founder-led firm: senior people do the work, and every team member works directly with leadership.
Winston & Miller is an Equal Opportunity Employer. All qualified applicants receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other characteristic protected by law. Winston & Miller participates in E-Verify and will provide the federal government with your Form I-9 information to confirm that you are authorized to work in the U.S. Applicants who need a reasonable accommodation during the application process may contact jessica@winstonandmiller.com.