Senior Information Security Engineer (ISSO) (Remote, US)

About this role

Lumen is the trusted network for the AI‑powered world, connecting people, data, and applications through our expansive fiber network and connected ecosystem. We enable secure, high‑performance connectivity across cloud, edge, and AI workloads for enterprises, governments, and communities.
At Lumen, you’ll work on infrastructure customers rely on today and build for what’s next, where performance, security, and resilience matter.
This is a high accountability environment where bold ideas drive real innovation for our customers, partners, and industry. The work is challenging, expectations are clear, and trust is built into how we operate. If you’re ready to take ownership, deliver meaningful impact, and help shape the future of AI‑ready connectivity, join us today.

The Role

At Lumen, the Senior Information Security Engineer (Senior ISSO) plays a critical role in advancing secure, compliant solutions for federal customers while supporting the execution of compliance activities across managed services environments. This is a hands-on role where you will work directly with Lead and Senior Lead ISSOs, engineering teams, program stakeholders, and customers to address ATO challenges, support assessment readiness, and help maintain the security posture of regulated systems.

The Senior ISSO serves as an experienced security practitioner responsible for performing RMF activities, maintaining authorization documentation, evaluating compliance requirements, and supporting continuous monitoring efforts. The pace is fast, the expectations are high, and the work is often complex. Success requires strong attention to detail, sound technical judgment, and the ability to collaborate effectively across teams. For those motivated to grow their expertise and contribute to meaningful outcomes in highly regulated environments, Lumen offers opportunities to develop advanced skills while supporting critical public sector customers.

The Senior ISSO operates as a customer-facing security practitioner responsible for supporting system authorization activities by helping align managed services, architectures, and implementations with federal compliance requirements. This includes contributing to authorization artifacts, supporting assessments, and coordinating with technical teams to maintain compliance and operational readiness.

The successful candidate will demonstrate the ability to:

• Support execution of the full RMF lifecycle, including categorization, control implementation, assessment readiness, authorization support, and continuous monitoring.

• Develop, maintain, and ensure accuracy of authorization artifacts (e.g., SSP, POA&M, control evidence, implementation narratives, and supporting documentation).

• Support activities necessary to maintain ATO compliance and audit readiness for assigned systems.

• Assist with vulnerability management, audit response, corrective action plans, and remediation tracking activities.

• Conduct security and compliance reviews to identify gaps, risks, and improvement opportunities.

• Support system-level risk assessments and provide recommendations regarding control implementation and remediation activities.

• Monitor vulnerability, audit, and continuous monitoring data to maintain awareness of system security posture.

• Coordinate with engineering, operations, and program teams to support implementation of security controls and corrective actions.

• Participate in security assessments, audits, and inspections, including interactions with assessors and customer stakeholders.

• Review security documentation, control evidence, and implementation artifacts for accuracy and completeness.

• Evaluate products, services, and proposed technical solutions for compliance, risk, and implementation considerations.

• Support customer integration of managed services by assisting with control implementation, inheritance analysis, and security documentation activities.

• Contribute RMF and compliance expertise to solution implementation, delivery efforts, and operational improvement initiatives.

• Maintain awareness of evolving federal compliance requirements, security threats, and industry best practices.

The Main Responsibilities

• Strong working knowledge of NIST RMF (SP 800-37) and NIST SP 800-53 control framework.

• Demonstrated experience performing RMF activities and supporting authorization efforts for federal or regulated systems.

• Experience supporting FedRAMP and/or FISMA authorization processes, including documentation development and assessment support.

• Ability to execute assigned security and compliance activities with limited supervision.

• Understanding of control implementation, inheritance concepts, and shared responsibility models.

• Ability to assess security risks and communicate findings clearly to technical and non-technical stakeholders.

• Experience evaluating security and compliance considerations associated with products, services, and architecture.

• Working knowledge of cryptographic fundamentals and emerging security technologies, including post-quantum cryptography (PQC).

• Strong collaboration skills across engineering, operations, program management, and security teams.

• Effective written and verbal communication skills.

• Demonstrates Lumen leadership behaviors (teamwork, trust, transparency, clarity, courage, customer focus, growth mindset, respect).

What We Look For in a Candidate

Education and Experience:

• Bachelor's degree in information assurance, cybersecurity, or a related field, or equivalent experience.

• Minimum of 3 years of relevant experience in information assurance, governance, risk, and compliance, or cybersecurity.

• Demonstrated experience supporting RMF activities, security assessments, audits, or authorization efforts.

• Experience developing or maintaining authorization artifacts (e.g., SSPs, POA&Ms, security plans, assessment evidence, or related documentation).

• Experience operating in…