ISSO/ISCM Lead

K2United is an organization that houses two distinct, national, customer-facing brands tied together by a shared purpose: setting the standard for an extraordinary workplace. Through our brands, K2Share and CareerSafe, we provide advisory services in cyber risk management and online education for workforce readiness.

Our four core values define how we show up every day:

• Respect Others - We lead with respect, building trust and connection.
• Internally Driven - We are relentlessly compelled to accomplish our objectives.
• Collaborative Innovation - We create by listening, sharing, and working together.
• Client Success - We hold our clients' mission as our own.

We believe in people who are accountable, curious, and motivated to make an impact that matters.

Our programs make a meaningful difference. CareerSafe supports more than two million users each year, while K2Share delivers cybersecurity and IT solutions that strengthen federal agencies. As part of our team, you'll help solve complex challenges in a mission-driven, small-business environment that values professional growth, collaboration, and work-life balance.

Key Responsibilities 

• Manage the ISCM program and perform internal controls testing to sustain persistent authorization and compliance across all enterprise systems. 
• Maintain and update A&A packages — System Security Plans, Configuration Management Plans, and Contingency and Disaster Recovery Plans — conforming to NIST SP 800-18 and USAC standards. 
• Support systems undergoing new authorization, reauthorization, and ongoing authorization; identify compliance gaps and prepare risk-informed recommendations for management review. 
• Execute internal Security Control Assessments and controls testing for minor systems, interim authorizations, and FedRAMP SaaS offerings using NIST SP800-53A as a guide, as directed. 
• Own POA&M tracking, analysis, and reporting: document findings, monitor due dates and milestone dates, collect and validate closure evidence, and report on open, overdue, closed, and risk-accepted items with aging trend analysis. 
• Collaborate with Security Engineers to ensure all configuration data — failed  settings, technical deviations, and accepted risk decisions — is explicitly tracked within the system authorization boundary in the GRC system of record (e.g., Xacta). 
• Perform Security Impact Analyses for requested deviations and facilitate the risk acceptance process with the USAC CISO and ISSM; ensure all approved deviations are reviewed annually for continued necessity. 
• Serve as primary technical support and point of contact for all internal and external audits and assessments; drive artifact collection including logs, system configurations, and access lists, and validate evidence for completeness, accuracy, and oversight quality. 
• Participate in accreditation interviews and audit meetings, providing technical insight into incident response and monitoring activities. 
• Act as liaison between the client business units and the OCISO; facilitate weekly security meetings and manage inquiries on system modifications, implementation initiatives, and problem resolution. 
• Conduct routine reviews of audit logs, patching status, access lists, and incident response testing; perform annual policy and procedure gap analyses against federal requirements. 

• Bachelor's degree in information systems, cybersecurity, computer science, or a related field. Equivalent experience considered in lieu of degree. 
• Eight or more years in federal or federally regulated information security compliance, including at least three years in an ISSO, ISSM, or continuous monitoring lead capacity. 
• Demonstrated hands-on ownership of RMF and A&A lifecycle activities under NIST SP 800-37, including authorship and maintenance of SSPs, CMPs, and contingency plans. 
• Direct experience supporting FISMA audits (OIG, IG, or independent assessor) as artifact owner or primary technical liaison. 
• Working proficiency with NIST SP 800-53 Rev. 5, SP 800-53A, SP 800-137, and SP 800-18. 
• Demonstrated experience administering a GRC or authorization tool of record — Xacta, eMASS, CSAM, RSA Archer, ServiceNow IRM, or equivalent. 
• Experience managing POA&M lifecycles at enterprise scale, including risk acceptance workflows with a CISO or authorizing official. 

Preferred Qualifications 

• Experience in a FISMA-adjacent non-agency environment — a federally chartered corporation, USF administrator, or similar entity where federal standards apply by memorandum of understanding rather than direct statute. 
• Familiarity with FedRAMP authorization packages and SaaS control inheritance. 
• Experience supporting Privacy Act systems of records and PII control implementation under OMB M-17-12. 

Required Certifications 

CISSP, or an equivalent information security governance and risk certification demonstrating substantially similar competency and approved by USAC (for example CISM or CGRC/CAP). CISSP is strongly preferred for evaluation positioning. 

Applicants must be willing to take a drug test and submit to a credit and background investigation as part of the selection process. 

The U.S. government restricts access by Foreign Nationals to certain types of technology and technical data. Consequently, this posting is intended only for U.S. citizens.
 

K2United, LLC is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, or protected Veteran status.
 

This job description is not an exhaustive list of job responsibilities. K2United management reserves the right to change or alter this job description at any time without notice.