Xacta SaaS Information System Owner (ISO)

About the role

Telos Corporation seeks an experienced Information System Owner (ISO) to provide security, risk, compliance, and authorization leadership for a FedRAMP-authorized Cloud Service Offering (CSO). The ISO will serve as the accountable operational owner for maintaining the system’s availability, security, and authorization/certification posture, ensuring alignment with applicable FedRAMP and NIST requirements.

Responsibilities

• Serve as the primary operational owner for the CSO’s FedRAMP Certification and operational posture.
• Maintain alignment among the production environment, authorization boundary, System Security Plan (SSP), security controls, architecture documentation, inventories, policies, procedures, and supporting evidence.
• Coordinate FedRAMP continuous monitoring activities and required recurring deliverables.
• Oversee availability, vulnerability management, remediation tracking, POA&M activities, deviations, exceptions, and risk-acceptance processes.
• Evaluate infrastructure, application, architecture, and configuration changes for security, compliance, and authorization impact.
• Coordinate control owners and technical teams to ensure NIST SP 800-53 security requirements are appropriately implemented and evidenced.
• Partner with DevSecOps and engineering teams on secure cloud architecture, CI/CD processes, configuration management, IAM, logging, encryption, vulnerability management, and related security capabilities.
• Coordinate responses to 3PAO assessments, annual assessments, penetration testing, government reviews, customer inquiries, and evidence requests.
• Evaluate findings and security issues based on technical severity, operational impact, regulatory requirements, and overall system risk.
• Escalate significant risks, compliance deficiencies, and authorization concerns to appropriate technical and executive stakeholders.
• Support incident response, contingency planning, system recovery, and related FedRAMP operational security requirements.
• Identify opportunities to automate security and compliance activities, including control evidence collection, asset reconciliation, vulnerability workflows, compliance telemetry, and recurring reporting.
• Develop security and risk metrics that provide leadership with visibility into the CSO’s operational and authorization posture.
• Promote continuous improvement of security, compliance, and DevSecOps processes.

Required Qualifications

• US Citizen.
• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related discipline, or equivalent combination of education and relevant professional experience.
• One or more relevant professional certifications such as CISSP, CISM, CCSP, CGRC, or comparable cybersecurity credentials.
• Approximately 5–7 years or more of progressive experience in cybersecurity, information assurance, cloud security, security operations, or related disciplines.
• Demonstrated experience supporting FedRAMP, NIST Risk Management Framework (RMF), FISMA, or comparable federal security authorization environments.
• Experience with System Security Plans, Plans of Action and Milestones (POA&Ms), continuous monitoring, vulnerability management, security control assessments, control evidence collection, and risk-management activities.
• Experience with Xacta or other GRC platforms.
• Experience operating or securing enterprise cloud or SaaS environments.
• Working knowledge of cloud security concepts including identity and access management, network security, encryption, logging and monitoring, vulnerability scanning, configuration management, and incident response.
• Ability to interpret technical vulnerability, configuration, and security data and translate findings into remediation priorities and risk decisions.
• Experience coordinating security activities across engineering, operations, cybersecurity, and compliance teams.
• Experience supporting security assessments, audits, or independent third-party assessments.
• Strong analytical, written, verbal, and executive communication skills.
• Ability to communicate technical and regulatory issues effectively to both technical and non-technical stakeholders.

Preferred Qualifications

• Direct experience supporting or maintaining a FedRAMP CSO environment.
• AWS certification or related cloud security certification.
• Working knowledge and use of Artificial Intelligence (AI) tools, prompt engineering, and agentic workflows.
• Experience interacting directly with 3PAOs, government assessors, or authorizing organizations.
• Experience with DevSecOps environments, CI/CD pipelines, containers, Kubernetes, infrastructure as code, and automated security tooling.
• Experience with API security, automated evidence collection, and continuous control monitoring.
• Familiarity with FedRAMP 20x and machine-readable security and compliance standards like OSCAL.
• Experience integrating security telemetry from vulnerability scanners, cloud platforms, SIEM systems, CI/CD pipelines, and related security tools.
• Experience supporting federal government customers or regulated cloud environments.

Benefits

• Generous paid time off.
• Medical, dental, and vision coverage.
• Tuition reimbursement.
• 401k.

Pay

$105K – $130K.

Schedule

Position based in Ashburn, VA.