ISSO/MARS-E Lead

Description

Position Summary

Owns Marketplace security compliance posture and the MARS-E suite lifecycle, providing authoritative control interpretation and standardization, overseeing ATO artifacts and evidence quality, coordinating with ISPG and ADO ISSOs, managing risk/exception processes, and leading audit readiness. The role aligns to CMS governance where “System Security and Privacy Officer” functions (previously known as ISSO) are explicitly required to implement safeguards under IS2P2.

This position is contingent upon a contract award.

Key Responsibilities

• Operational (compliance execution)
• Maintains and improves the Marketplace’s security and privacy compliance posture through the MARS-E document suite and related evidence repositories, ensuring artifacts remain audit-ready and current. Ensures MARS-E governance discipline: MARS-E is a risk-based security/privacy framework suite for Exchange IT systems under CMS oversight, and changes to the suite require approvals by CMS senior officials (CIO, Senior Agency Official for Privacy, CISO).

• Managerial (coordination and oversight)
• Coordinates across multiple ADO ISSOs and system teams to standardize control implementations and evidence quality, functioning as a portfolio-level compliance integrator rather than as a system-only ISSO. Works with ISPG and enterprise stakeholders to drive risk decisions, waiver/deviation processes, and consistent application of CMS ARS requirements.

• Security-specific (RMF / ATO / continuous monitoring)
• Leads or materially supports RMF execution activities—categorization, control selection, implementation oversight, assessment readiness, authorization package hygiene, and continuous monitoring—consistent with NIST RMF’s structured lifecycle. Uses NIST SP 800-53 as the control catalog basis and NIST SP 800-53A as the assessment procedure basis for validating control effectiveness and readiness for audits/authorizations. Ensures Marketplace systems align with CMS ARS minimum controls and related policy expectations, including processes for ATO and POA&M management supported by CMS governance.

Requirements

Required Qualifications

• •Education: Bachelor’s degree in cybersecurity, information systems, engineering, or equivalent experience.
• Experience: 8–12+ years in cybersecurity risk/compliance; 5+ years hands-on federal RMF/ATO work (SSP/assessment artifacts/continuous monitoring).
• •Demonstrated ability to manage control baselines and assessment artifacts at scale using MARS-E/ARS-like overlays (MARS-E v2.2 explicitly maps across NIST baselines and CMS ARS baselines to support consistent control selection).
• •Recommended Certifications minimum: one senior security credential demonstrating breadth in governance/risk/control frameworks (e.g., CISSP, CISM, CAP, GSLC or equivalent), with evaluation focused on ability to execute RMF and lead evidence quality rather than on certificate count.

• Required Clearances / Federal Suitability
• Suitability: Must meet CMS background investigation requirements for contractor fitness/suitability prior to access.
• Public Trust: Must be able to obtain.

Knowledge / Skills / Abilities

• •Mastery of RMF lifecycle orchestration and the ability to operate in a “continuous monitoring” posture rather than point-in-time compliance, consistent with RMF principles.
• •Deep familiarity with NIST control structure and assessment rigor (SP 800-53 and SP 800-53A).
• •Working knowledge of CMS ARS as the minimum required baseline and how it is used at CMS to provide defense-in-depth and least privilege, and how waivers/deviations flow for review/risk acceptance.
• •Ability to lead “evidence quality” as a product: clear writing, traceability of control statements to implemented mechanisms, and audit-ready documentation discipline.

Preferred Qualifications

• •Direct experience applying MARS-E in Exchange/Marketplace ecosystems and managing the “suite” change-control rigor described in the MARS-E documentation itself.
• •Experience coordinating investigations and evidence preservation practices aligned to incident handling and forensic support expectations (NIST incident response guidance emphasizes structured incident handling and analysis).
• •Experience in environments with high volumes of external partner agreements and federated evidence intake (state administering entities / non-exchange entities), including repository administration and lifecycle tracking.

ABOUT US

Precise Software Solutions, Inc. is a mission-focused technology services company delivering secure digital platforms, infrastructure, and operational IT services to government organizations. A CMMI Level 3–appraised company, Precise partners with agency technology leaders and solution providers to design, build, operate, and modernize enterprise IT solutions that support critical public missions combining agility, innovation, and performance to deliver measurable results.

Precise specializes in cloud and hybrid infrastructure, platform engineering, security operations and compliance, application modernization, and data platforms and analytics. The company is known for its agile, delivery-driven approach and innovative engineering practices, applying operational rigor and performance-focused execution to improve system resilience, security, and scalability across complex government environments.

BENEFITS AND PERKS

• •Comprehensive Health Benefits (Medical, Dental and Vision)
• •Flexible Spending Accounts (FSA) & Health Savings Account (HSA)
• •Retirement Plan with 4% match and discretionary match at year end
• •Paid Time Off (PTO): 15 days of PTO accrued per year; 7 holidays+ 3 Floating holidays; 2 Innovation days (paid training days)
• •Short Term and Long-Term Disability
• •Paid Parental Leave
• •Paid Jury Duty leave
• •Life and AD&D Insurance
• •Critical Illness Insurance
• •Training and Development
• •Wellness Incentives & Discount programs
• •Employee Referral Program
• •Annual Charity Donation Match
• •Awards and Recognition

Equal Employment Opportunity Statement

Precise Software Solutions is committed to providing a workplace free from discrimination and harassment. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, age, national origin, disability, sexual orientation, gender identity or expression, marital status, genetic information, protected veteran status, or other legally protected status.

We are an inclusive organization and actively promote equality of opportunity for all with the right mix of talent, skills and potential. We expect every member of the Precise community to do their part to cultivate and maintain an environment where everyone has the opportunity to feel included and is afforded the respect and dignity they deserve.