Staff Security Engineer, Incident Response

Are you passionate about driving security compliance in complex cloud environments and helping organizations maintain trusted relationships with government stakeholders?

Do you enjoy collaborating across engineering, security, and operations teams to deliver secure, compliant solutions that make a meaningful impact?

About the Business

LexisNexis® Risk Solutions provides customers with solutions and decision tools that combine public and industry specific content with advanced technology and analytics to assist them in evaluating and predicting risk and enhancing operational efficiency. We use the power of data and advanced analytics to help our customers make better, timelier decisions. By bringing clarity to information, we ultimately help make communities safer, insurance rates more accurate, commerce more transparent, business decisions easier and processes more efficient.

You can learn more about LexisNexis Risk at

About our team

Our team is composed of highly technical professionals who thrive on solving complex security, cloud, and compliance challenges. We foster a collaborative, engineering-focused culture where team members are empowered to lead difficult initiatives, drive innovation, and deliver outcomes in highly regulated environments.

About the Role

We are seeking an experienced Information System Security Officer (ISSO) to lead and maintain the security and compliance posture of our recently obtained FedRAMP-authorized cloud environment. The ISSO will serve as the primary security compliance lead responsible for ensuring ongoing adherence to FedRAMP, NIST 800-53, FISMA, and organizational security requirements. This role will partner with Engineering, Cloud Operations, DevOps, Product, and Compliance teams to maintain authorization, manage continuous monitoring activities, support audits and assessments, and drive security improvements across the platform. The ideal candidate combines strong cybersecurity knowledge with hands-on experience managing FedRAMP-authorized systems in cloud environments such as Azure, AWS, or GCP.

Key Responsibilities

FedRAMP Program Management

Serve as the designated ISSO for FedRAMP-authorized systems.
Maintain the organization's Authority to Operate (ATO) and support ongoing compliance activities.
Lead FedRAMP continuous monitoring activities, including monthly, quarterly, and annual reporting requirements.
Coordinate annual assessments, independent audits, penetration testing, and security reviews with Third Party Assessment Organizations (3PAOs).
Manage security-related communications with federal agencies, sponsoring organizations, and stakeholders.

Risk & Security Management

Conduct security risk assessments and vulnerability analyses.
Review, assess, and monitor Plan of Action & Milestones (POA&M) items through remediation.
Evaluate security impacts of system changes and support Significant Change Request (SCR) submissions.
Ensure proper implementation and effectiveness of NIST 800-53 security controls.
Facilitate security reviews for architecture changes, new technologies, and cloud deployments.

Compliance & Documentation

Maintain FedRAMP security documentation including:
- System Security Plan (SSP),
- Security Assessment Reports (SAR)
- POA&M
- Configuration Management Plan
- Incident Response Plan
- Continuous Monitoring Strategy
- Contingency Planning Documentation
Review and approve security documentation updates resulting from system changes.
Ensure evidence collection and compliance artifacts are complete and audit-ready.

Continuous Monitoring

Manage POA&M deliverables for the sponsor.
Monitor security events, incidents, and compliance metrics.
Validate remediation efforts for identified security findings.
Ensure required security assessments are completed according to established schedules.
Track compliance KPIs and report status to leadership.

Security Operations & Incident Response

Participate in security incident investigations and response efforts.
Coordinate with security operations teams to ensure timely identification and remediation of threats.
Support root cause analysis and corrective action planning following incidents.
Review security monitoring tools and processes to improve detection and response capabilities.

Cross-Functional Collaboration

Partner with Engineering and DevOps teams to integrate compliance into system development and deployment processes.
Provide security guidance throughout the SDLC.
Support cloud migration, modernization, and technology transformation initiatives.
Ensure compliance and security awareness training meet FedRAMP requirements.
Matrix manage resources participating in the FedRAMP Program.

Required Qualifications

Education

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related field.
Equivalent work experience may be considered in lieu of degree requirements.

Experience

5+ years of information security, cybersecurity, or compliance experience.

3+ years supporting FedRAMP, FISMA, or federal compliance programs.

Experience maintaining FedRAMP Moderate or High authorized environments.

Experience supporting security assessments, audits, and continuous monitoring activities.

Experience with cloud platforms such as AWS, Azure, or Google Cloud.

Technical Knowledge

Strong understanding of:

FedRAMP requirements

NIST SP 800-53

NIST 800-37 Risk Management Framework (RMF)

FISMA

NIST 800-171

Zero Trust Architecture principles

Vulnerability management processes

Security operations and incident response

Familiarity with security technologies including:

SIEM platforms

Vulnerability scanners

Endpoint detection and response (EDR)

Identity and Access Management (IAM)

Cloud-native security services

Preferred Qualifications

CISSP, CISM, GSLC, CAP, or equivalent cybersecurity certification.

FedRAMP-specific experience acting as:

ISSO

Security Compliance Manager

FedRAMP Program Manager

Experience supporting federal agencies or government contractors.

Knowledge of automated compliance platforms and Governance, Risk, and Compliance (GRC) tools.

Experience leveraging AI and automation to streamline compliance reporting, evidence collection, and POA&M management.

Experience with AWS GovCloud or Azure Government environments.

U.S. National Base Pay Range: $115,400 - $192,300. Geographic differentials may apply in some locations to better reflect local market rates.If performed in Colorado, the base pay range is $115,400 - $192,300.If performed in Illinois, the base pay range is $121,200 - $201,900.If performed in Chicago, IL, the base pay range is $126,900 - $211,500.If performed in Maryland, the base pay range is $121,200 - $201,900.If performed in New York, the base pay range is $126,900 - $211,500.If performed in New York City, the base pay range is $138,400 - $230,700.If performed in Rochester, NY, the base pay range is $115,400 - $192,300.If performed in New Jersey, the base pay range is $136,213 - $217,587.If performed in Ohio, the base pay range is $109,500 - $182,700.This job is eligible for an annual incentive bonus.Application deadline is 12/24/2026.

We know your well-being and happiness are key to a long and successful career. We are delighted to offer country specific benefits. Click here to access benefits specific to your location.

We are committed to providing a fair and accessible hiring process. If you have a disability or other need that requires accommodation or adjustment, please let us know by completing our Applicant Request Support Form or please contact 1-855-833-5120.

Criminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scams here.

Please read our Candidate Privacy Policy.

We are an equal opportunity employer: qualified applicants are considered for and treated during employment without regard to race, color, creed, religion, sex, national origin, citizenship status, disability status, protected veteran status, age, marital status, sexual orientation, gender identity, genetic information, or any other characteristic protected by law.

USA Job Seekers:

EEO Know Your Rights.

Originally posted on Himalayas

Job Description

Are you passionate about driving security compliance in complex cloud environments and helping organizations maintain trusted relationships with government stakeholders?

Do you enjoy collaborating across engineering, security, and operations teams to deliver secure, compliant solutions that make a meaningful impact?

About the Business

You can learn more about LexisNexis Risk at

About our team

About the Role

Key Responsibilities

FedRAMP Program Management

Serve as the designated ISSO for FedRAMP-authorized systems.
Maintain the organization's Authority to Operate (ATO) and support ongoing compliance activities.
Lead FedRAMP continuous monitoring activities, including monthly, quarterly, and annual reporting requirements.
Coordinate annual assessments, independent audits, penetration testing, and security reviews with Third Party Assessment Organizations (3PAOs).
Manage security-related communications with federal agencies, sponsoring organizations, and stakeholders.

Risk & Security Management

Conduct security risk assessments and vulnerability analyses.
Review, assess, and monitor Plan of Action & Milestones (POA&M) items through remediation.
Evaluate security impacts of system changes and support Significant Change Request (SCR) submissions.
Ensure proper implementation and effectiveness of NIST 800-53 security controls.
Facilitate security reviews for architecture changes, new technologies, and cloud deployments.

Compliance & Documentation

Maintain FedRAMP security documentation including:
- System Security Plan (SSP),
- Security Assessment Reports (SAR)
- POA&M
- Configuration Management Plan
- Incident Response Plan
- Continuous Monitoring Strategy
- Contingency Planning Documentation
Review and approve security documentation updates resulting from system changes.
Ensure evidence collection and compliance artifacts are complete and audit-ready.

Continuous Monitoring

Manage POA&M deliverables for the sponsor.
Monitor security events, incidents, and compliance metrics.
Validate remediation efforts for identified security findings.
Ensure required security assessments are completed according to established schedules.
Track compliance KPIs and report status to leadership.

Security Operations & Incident Response

Participate in security incident investigations and response efforts.
Coordinate with security operations teams to ensure timely identification and remediation of threats.
Support root cause analysis and corrective action planning following incidents.
Review security monitoring tools and processes to improve detection and response capabilities.

Cross-Functional Collaboration

Partner with Engineering and DevOps teams to integrate compliance into system development and deployment processes.
Provide security guidance throughout the SDLC.
Support cloud migration, modernization, and technology transformation initiatives.
Ensure compliance and security awareness training meet FedRAMP requirements.
Matrix manage resources participating in the FedRAMP Program.

Required Qualifications

Education

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related field.
Equivalent work experience may be considered in lieu of degree requirements.

Criminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scams here.

Please read our Candidate Privacy Policy.

USA Job Seekers:

EEO Know Your Rights.

Originally posted on Himalayas

Job Description

Are you passionate about driving security compliance in complex cloud environments and helping organizations maintain trusted relationships with government stakeholders?

Do you enjoy collaborating across engineering, security, and operations teams to deliver secure, compliant solutions that make a meaningful impact?

About the Business

You can learn more about LexisNexis Risk at

About our team

About the Role

Key Responsibilities

FedRAMP Program Management

Serve as the designated ISSO for FedRAMP-authorized systems.
Maintain the organization's Authority to Operate (ATO) and support ongoing compliance activities.
Lead FedRAMP continuous monitoring activities, including monthly, quarterly, and annual reporting requirements.
Coordinate annual assessments, independent audits, penetration testing, and security reviews with Third Party Assessment Organizations (3PAOs).
Manage security-related communications with federal agencies, sponsoring organizations, and stakeholders.

Risk & Security Management

Conduct security risk assessments and vulnerability analyses.
Review, assess, and monitor Plan of Action & Milestones (POA&M) items through remediation.
Evaluate security impacts of system changes and support Significant Change Request (SCR) submissions.
Ensure proper implementation and effectiveness of NIST 800-53 security controls.
Facilitate security reviews for architecture changes, new technologies, and cloud deployments.

Compliance & Documentation

Maintain FedRAMP security documentation including:
- System Security Plan (SSP),
- Security Assessment Reports (SAR)
- POA&M
- Configuration Management Plan
- Incident Response Plan
- Continuous Monitoring Strategy
- Contingency Planning Documentation
Review and approve security documentation updates resulting from system changes.
Ensure evidence collection and compliance artifacts are complete and audit-ready.

Continuous Monitoring

Manage POA&M deliverables for the sponsor.
Monitor security events, incidents, and compliance metrics.
Validate remediation efforts for identified security findings.
Ensure required security assessments are completed according to established schedules.
Track compliance KPIs and report status to leadership.

Security Operations & Incident Response

Participate in security incident investigations and response efforts.
Coordinate with security operations teams to ensure timely identification and remediation of threats.
Support root cause analysis and corrective action planning following incidents.
Review security monitoring tools and processes to improve detection and response capabilities.

Cross-Functional Collaboration

Partner with Engineering and DevOps teams to integrate compliance into system development and deployment processes.
Provide security guidance throughout the SDLC.
Support cloud migration, modernization, and technology transformation initiatives.
Ensure compliance and security awareness training meet FedRAMP requirements.
Matrix manage resources participating in the FedRAMP Program.

Required Qualifications

Education

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related field.
Equivalent work experience may be considered in lieu of degree requirements.

Criminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scams here.

Please read our Candidate Privacy Policy.

USA Job Seekers:

EEO Know Your Rights.

Originally posted on Himalayas

Job Description

Are you passionate about driving security compliance in complex cloud environments and helping organizations maintain trusted relationships with government stakeholders?

Do you enjoy collaborating across engineering, security, and operations teams to deliver secure, compliant solutions that make a meaningful impact?

About the Business

You can learn more about LexisNexis Risk at

About our team

About the Role

Key Responsibilities

FedRAMP Program Management

Serve as the designated ISSO for FedRAMP-authorized systems.
Maintain the organization's Authority to Operate (ATO) and support ongoing compliance activities.
Lead FedRAMP continuous monitoring activities, including monthly, quarterly, and annual reporting requirements.
Coordinate annual assessments, independent audits, penetration testing, and security reviews with Third Party Assessment Organizations (3PAOs).
Manage security-related communications with federal agencies, sponsoring organizations, and stakeholders.

Risk & Security Management

Conduct security risk assessments and vulnerability analyses.
Review, assess, and monitor Plan of Action & Milestones (POA&M) items through remediation.
Evaluate security impacts of system changes and support Significant Change Request (SCR) submissions.
Ensure proper implementation and effectiveness of NIST 800-53 security controls.
Facilitate security reviews for architecture changes, new technologies, and cloud deployments.

Compliance & Documentation

Maintain FedRAMP security documentation including:
- System Security Plan (SSP),
- Security Assessment Reports (SAR)
- POA&M
- Configuration Management Plan
- Incident Response Plan
- Continuous Monitoring Strategy
- Contingency Planning Documentation
Review and approve security documentation updates resulting from system changes.
Ensure evidence collection and compliance artifacts are complete and audit-ready.

Continuous Monitoring

Manage POA&M deliverables for the sponsor.
Monitor security events, incidents, and compliance metrics.
Validate remediation efforts for identified security findings.
Ensure required security assessments are completed according to established schedules.
Track compliance KPIs and report status to leadership.

Security Operations & Incident Response

Participate in security incident investigations and response efforts.
Coordinate with security operations teams to ensure timely identification and remediation of threats.
Support root cause analysis and corrective action planning following incidents.
Review security monitoring tools and processes to improve detection and response capabilities.

Cross-Functional Collaboration

Partner with Engineering and DevOps teams to integrate compliance into system development and deployment processes.
Provide security guidance throughout the SDLC.
Support cloud migration, modernization, and technology transformation initiatives.
Ensure compliance and security awareness training meet FedRAMP requirements.
Matrix manage resources participating in the FedRAMP Program.

Required Qualifications

Education

Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related field.
Equivalent work experience may be considered in lieu of degree requirements.

Criminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scams here.

Please read our Candidate Privacy Policy.

USA Job Seekers:

EEO Know Your Rights.

Originally posted on Himalayas