• ISSO for Hybrid General Support Systems and Major cloud applications (O365 and G-Suite) • Utilize the Risk Management Framework (RMF) process per NIST SP 800-37 on 4 applications to classify system categorizations, implement security controls, and develop and update security assessment plans and contingency plans • Ensuring System Authority to Operate (ATO) is obtained ahead of schedule and within budget • Develop, review, and maintain System Security Plan (SSP), Privacy Threshold Assessment (PTA), Privacy Impact Analysis (PIA), Business Impact Analysis, Contingency Plan, as well as other security documentation to ensure FISMA Compliance for new and pre-existing systems • Support systems in Assessment and Authorizations (A&As), create Risk Exposure Tables, Risk Assessment Reports, document findings and remediation actions as Plans of Actions and Milestones (POA&Ms), and develop ATO letters • Draft Policies and SOPs (i.e. Access Control Policy, Audit Policy, Access Control Procedure, Configuration Management Plan and Procedure, etc.) • Participate in weekly meetings to discuss the status of the assessment process • Worked with a team of 18 – assessors, system owners, and system engineers to assist in the development, categorization, implementation, assessment, and monitoring of common security controls (low systems were approximately 166 controls – each with multiple determine if statements, while the moderate systems were approximately 385 security controls – each with multiple determine if statements as well) • Monitor security controls (1/3rd of the security controls were assessed annually). Continuous monitoring of controls included assessing technical, management and operational security controls employed within and inherited by the information system in accordance with the organization-defined monitoring strategy. Most notably, controls associated with POAMs were prioritized for continuous monitoring post-authorization to ensure continuous compliance with security requirements • Communicate security posture and trends to executive managers via monthly security reports and quarterly briefings, Compliance, Information Security