Xacta SaaS Information System Owner (ISO)

The most security-conscious organizations trust Telos Corporation to protect their vital IT assets. The reputation of our company rests on the quality of our solutions and the integrity of our people. Explore what you can bring to our solutions in the areas of cyber, cloud and enterprise security.

Be a part of the Telos culture and see what sets us apart! Telos offers an excellent compensation package with benefits that include generous paid time off, medical, dental, vision, tuition reimbursement, and 401k. The salary range for this position is $120K - $130K. Our employees enjoy more than just a great work environment!

This position will be based at Ashburn, VA

We are seeking an experienced Information System Owner (ISO) to provide security, risk, compliance, and authorization leadership for a FedRAMP-authorized Cloud Service Offering (CSO). The ISO will serve as the accountable operational owner for maintaining the system's availability, security and authorization/certification posture, ensuring that the production environment remain aligned with applicable FedRAMP and NIST requirements.

This role requires a combination of cybersecurity expertise, cloud and DevSecOps knowledge, risk-management judgment, and the ability to coordinate activities across engineering, operations, security, compliance, product, and executive stakeholders. The successful candidate will be able to translate regulatory requirements into practical operational controls while identifying opportunities to automate compliance activities and reduce the cost and effort required to maintain authorization.

Responsibilities:

• Serve as the primary operational owner for the Xacta SaaS CSO's FedRAMP Certification, operational posture and hosted customers success and authority to operate.
• Maintain alignment among the production environment, authorization boundary, System Security Plan (SSP), security controls, architecture documentation, inventories, policies, procedures, and supporting evidence.
• Coordinate FedRAMP continuous monitoring activities and required recurring deliverables.
• Oversee availability, vulnerability management, remediation tracking, POA&M activities, deviations, exceptions, and risk-acceptance processes.
• Evaluate infrastructure, application, architecture, and configuration changes for security, compliance, and authorization impact.
• Coordinate control owners and technical teams to ensure NIST SP 800-53 security requirements are appropriately implemented and evidenced.
• Partner with DevSecOps and engineering teams on secure cloud architecture, CI/CD processes, configuration management, IAM, logging, encryption, vulnerability management, and related security capabilities.
• Coordinate responses to 3PAO assessments, annual assessments, penetration testing, government reviews, customer inquiries, deliverables and evidence requests.
• Evaluate findings and security issues based on technical severity, operational impact, regulatory requirements, and overall system risk.
• Escalate significant risks, compliance deficiencies, and authorization concerns to appropriate technical and executive stakeholders.
• Support incident response, contingency planning, system recovery, and related FedRAMP operational security requirements.
• Identify opportunities to automate security and compliance activities, including control evidence collection, asset reconciliation, vulnerability workflows, compliance, service level telemetry, and recurring reporting.
• Develop security and risk metrics that provide leadership with visibility into the CSO's operational and customer authorization posture.
• Promote continuous improvement of security, compliance, and DevSecOps processes.