Mid-level ISSO to develop and execute a system categorization methodology for the FBI ISSO/ISSE Program, organizing IT systems by security, operational, and mission attributes while supporting compliance, risk management, and cost allocation reporting.
What you'll do
- Develop and maintain documented methodology for categorizing FBI IT systems by classification level, FIPS-199 impact, hosting environment, CNSS overlays, data types, mission function, and National Security System designation
- Apply categorization methodology to assigned systems on schedule and ensure alignment with NIST RMF, FIPS-199, CNSS policies, and FBI cybersecurity directives
- Analyze systems for risk, operational impact, and security posture to determine appropriate ISSO/ISSE support levels and labor allocation by seniority
- Maintain clear documentation supporting system grouping decisions, labor mapping, and support rationale; coordinate with program leadership and COR for methodology validation
- Provide monthly reporting inputs on labor allocation, cost recovery, and chargeback by system and FBI division; assist with Monthly Statement Reports (MSRs)
- Track system, policy, technology, and organizational changes affecting categorization logic; update methodology and workflows within required timeframes
- Support ATO lifecycle activities, POA&M tracking, risk assessments, compliance documentation, and audit readiness efforts
Mission
This role directly supports the FBI's ISSO/ISSE Program Management Office, helping standardize how the Bureau categorizes and organizes its information technology systems across on-premises, Azure, and AWS environments. The program ensures consistent application of federal security frameworks (FIPS-199, NIST RMF, CNSS 1253) while enabling effective labor allocation and compliance tracking across FBI divisions.
Required skills
- FIPS-199 categorization and implementation
- NIST RMF (Risk Management Framework) processes
- NIST SP 800-37 and 800-53 compliance
- CNSS 1253 overlays and policies
- GRC tools and security data management
- System security control compliance and risk assessment
- Federal cybersecurity compliance and documentation
- ATO lifecycle and POA&M tracking
- Cost allocation, labor mapping, and chargeback reporting
- Stakeholder coordination and technical communication