Principal ISSO (DevSecOps & Governance)

Key Responsibilities

• Agile & DevSecOps Governance: Serve as the primary cybersecurity representative within Agile Release Trains (ARTs); participate in Program Increment (PI) Planning to ensure security requirements, risks, and remediation items are embedded directly into team backlogs.
• Security Architecture & Design Reviews: Conduct comprehensive threat modeling, risk assessments, and design reviews across cloud, application, network, and emerging tech environments to identify gaps and recommend compensating controls.
• Risk Management & Compliance: Develop, maintain, and enforce enterprise security baselines and policies aligned with NIST RMF, NIST CSF, CIS Controls, and regulatory obligations; evaluate exception requests and facilitate executive risk-acceptance decisions.
• Vulnerability & Incident Management: Review vulnerability scan and penetration test results, prioritize remediation with development/infrastructure teams, track corrective actions, and provide expert guidance during incident response and containment efforts.
• Stakeholder & Audit Collaboration: Partner closely with Solution Architects, Product Managers, RTEs, and executive leaders to communicate security postures; author and maintain key governance artifacts (SSPs, SDDs, risk assessments) to support internal, external, and federal audits.

Required Qualifications

• Experience: 10+ years of progressive cybersecurity experience across security architecture, risk management, engineering, and compliance in large-scale enterprise environments.
• Framework Mastery: Deep, hands-on knowledge of cybersecurity governance frameworks, specifically NIST RMF, NIST CSF, CIS Controls, and UCF.
• Agile & Technical Integration: Proven track record supporting Agile delivery methodologies (ARTs, PI Planning) and integrating security toolchains into modern DevSecOps pipelines.
• Certification: Active CISSP certification is required.
• Technical Tooling: Experience evaluating vulnerabilities and threat data using enterprise security tools (e.g., Nessus, Checkmarx, Qualys, Tenable, Burp Suite, or Nmap).
• Communication: Exceptional written and verbal communication skills with a proven ability to translate complex security risks into actionable guidance for both technical engineering teams and C-suite stakeholders.

Preferred Qualifications

• Additional industry-standard security certifications (e.g., CISM, CRISC, CISA, CASP+, or Security+).
• Experience implementing automated security gates within Enterprise DevSecOps toolchains.
• Prior experience supporting large-scale enterprise or public sector/federal programs in the D.C. metro area.