Principal ISSO (DevSecOps & Governance) -- W2 Only

Principal ISSO (DevSecOps & Governance) -- W2 Only

Washington, DC - Onsite

We are seeking a high-caliber Principal ISSO (DevSecOps & Governance) to serve as a strategic cybersecurity leader and trusted advisor for our client in the Washington, D.C. area. In this high-visibility role, you will embed cybersecurity into large-scale Agile Release Trains (ARTs) and business portfolios, ensuring robust security-by-design and DevSecOps principles are integrated throughout the system development lifecycle. You will lead risk assessments, conduct security architecture reviews, enforce enterprise security standards aligned with NIST frameworks, and serve as the vital bridge between technology teams, product owners, and executive leadership.

Key Responsibilities

Agile & DevSecOps Governance: Serve as the primary cybersecurity representative within Agile Release Trains (ARTs); participate in Program Increment (PI) Planning to ensure security requirements, risks, and remediation items are embedded directly into team backlogs.

Security Architecture & Design Reviews: Conduct comprehensive threat modeling, risk assessments, and design reviews across cloud, application, network, and emerging tech environments to identify gaps and recommend compensating controls.

Risk Management & Compliance: Develop, maintain, and enforce enterprise security baselines and policies aligned with NIST RMF, NIST CSF, CIS Controls, and regulatory obligations; evaluate exception requests and facilitate executive risk-acceptance decisions.

Vulnerability & Incident Management: Review vulnerability scan and penetration test results, prioritize remediation with development/infrastructure teams, track corrective actions, and provide expert guidance during incident response and containment efforts.

Stakeholder & Audit Collaboration: Partner closely with Solution Architects, Product Managers, RTEs, and executive leaders to communicate security postures; author and maintain key governance artifacts (SSPs, SDDs, risk assessments) to support internal, external, and federal audits.

Required Qualifications

Experience: 10+ years of progressive cybersecurity experience across security architecture, risk management, engineering, and compliance in large-scale enterprise environments.

Framework Mastery: Deep, hands-on knowledge of cybersecurity governance frameworks, specifically NIST RMF, NIST CSF, CIS Controls, and UCF.

Agile & Technical Integration: Proven track record supporting Agile delivery methodologies (ARTs, PI Planning) and integrating security toolchains into modern DevSecOps pipelines.

Certification: Active CISSP certification is required.

Technical Tooling: Experience evaluating vulnerabilities and threat data using enterprise security tools (e.g., Nessus, Checkmarx, Qualys, Tenable, Burp Suite, or Nmap).

Communication: Exceptional written and verbal communication skills with a proven ability to translate complex security risks into actionable guidance for both technical engineering teams and C-suite stakeholders.

Preferred Qualifications

Additional industry-standard security certifications (e.g., CISM, CRISC, CISA, CASP+, or Security+).

Experience implementing automated security gates within Enterprise DevSecOps toolchains.

Prior experience supporting large-scale enterprise or public sector/federal programs in the D.C. metro area.