Accountabilities

Own authorization status, security risk posture, privacy compliance, and continuous monitoring activities across an assigned portfolio of information systems.

Manage multiple concurrent Risk Management Framework (RMF) workflows through eMASS and other Governance, Risk, and Compliance (GRC) platforms, including Xacta, RegScale, and CSAM, from system categorization through continuous monitoring.

Direct, mentor, and coordinate ISSO teams, assign responsibilities, review authorization packages, and ensure documentation meets applicable security and privacy requirements.

Lead privacy authorization activities across systems, including the preparation of Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), and System of Records Notice (SORN) determinations.

Implement and oversee privacy controls aligned with the Privacy Act, OMB Circular A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Revision 5, and CNSSI 1253 privacy overlays.

Work with Information Systems Security Engineers (ISSEs) and Solutions Architects to identify, map, and document PII and CUI data flows across cloud-native systems and technical architectures.

Evaluate security and privacy risks across the system portfolio, recommend risk acceptance decisions and Plans of Action and Milestones (POA&Ms), and escalate significant issues to leadership and Authorizing Officials.

Maintain incident and data breach response procedures aligned with federal and DoD requirements, helping reduce exposure and support effective response.

Establish standardized privacy templates, training materials, and repeatable authorization workflows to improve consistency and efficiency across the wider team.

Report on authorization status, privacy compliance, risk posture, and emerging trends to senior leadership and government stakeholders.

Serve as a primary government-facing security and privacy contact, supporting assessments, authorization decisions, and reciprocity discussions.

Requirements

At least 7 years of hands-on experience in DoD cybersecurity, RMF authorization, or information assurance.

At least 3 years in an ISSM, Lead ISSO, or equivalent leadership role with accountability for multiple ATO packages.

At least 3 years of direct federal or DoD privacy experience, including preparing PTAs and PIAs, making SORN determinations, and implementing privacy controls.

Advanced practical experience managing authorization packages in eMASS, along with strong proficiency in at least one additional GRC platform such as Xacta, RegScale, or CSAM.

Expert knowledge of NIST SP 800-53 (Revisions 4 and 5), NIST SP 800-37 RMF, CNSSI 1253, privacy overlays, and relevant DoD implementation guidance.

Strong understanding of federal privacy requirements, including the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.

Demonstrated ability to lead, mentor, and quality-review ISSOs or compliance professionals while managing several authorization initiatives simultaneously.

Technical familiarity with cloud environments and modern software architectures, including AWS, containers, Kubernetes, and CI/CD pipelines, with the ability to translate cloud-native designs into appropriate security and privacy controls.

Active U.S. Secret security clearance.

DoD 8570/8140 IAM Level II baseline certification, such as CISSP, CISM, or CASP+, or the ability to obtain one within 90 days.

IAPP privacy certification, such as CIPP/G, CIPP/US, CIPM, or CIPT, or the ability to obtain one within 6 months.

Strong written and verbal communication skills, including the ability to brief Authorizing Officials, privacy officers, and senior executives on security risks, authorization status, and compliance.

U.S. citizenship is required.

Location requirement: Candidates must reside in one of the approved hiring hubs: Washington, D.C./Maryland/Virginia or Denver/Colorado Springs, Colorado.

A proactive, solutions-oriented approach, with strong personal accountability, autonomy, teamwork, and a focus on measurable results.

Benefits

Annual base salary of $170,000–$180,000, depending on professional background, technical expertise, seniority, and regional factors.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1