Information Systems Security Officer (ISSO) (27.1)*

SierTeK proudly serves our clients by providing expertise in the Program Management, Information Technology, and Administrative Support domains. Founded in 2007 as a minority and service-disabled veteran-owned company, we serve as prime- and subcontractor for a multitude of Federal Department of Defense contracts. By focusing on continual improvement, our services remain at the forefront of our industry, and we pride ourselves on delivering our services with the highest degree of integrity.

SierTeK Ltd. is seeking two (2) Information System Security Officers to support an opportunity at JBSA-Fort Sam Houston.

Position Overview Section 

SierTeK is seeking an experienced Information System Security Officer (ISSO) to provide cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves and systems supporting Air Force Research Laboratory (AFRL) operations.

The ISSO will support cybersecurity activities across a distributed AFRL organization, with a primary focus on Risk Management Framework (RMF) compliance, Authorization to Operate (ATO) management, cybersecurity assessments, vulnerability management, eMASS administration, security documentation, access management, and DoD cybersecurity workforce requirements.

The ideal candidate will have a strong understanding of DoD cybersecurity policies and RMF processes, excellent communication and organizational skills, and the ability to work independently while providing cybersecurity guidance and support to technical personnel, leadership, and organizational stakeholders.

Essential Job Functions

• Provide Information Systems Security Officer (ISSO) cybersecurity support in accordance with DoD 8140 Cyberwarfare Code 721 requirements.
• Provide cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves and systems.
• Serve as a cybersecurity consultant and advisor to unit technicians and organizational personnel.
• Administer, coordinate, and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, policies, and supplemental guidance across the distributed AFRL organization.
• Ensure Risk Management Framework (RMF) requirements are satisfied and that applicable Authority to Operate (ATO) authorizations are obtained and maintained.
• Maintain current and accurate cybersecurity documentation, records, and supporting artifacts.
• Support configuration management reviews and maintenance to ensure appropriate security mechanisms are implemented.
• Maintain AFRL IT portfolio and cybersecurity information within Information Technology Investment Portfolio System (ITIPS), AFRL RMF Workflow, and Enterprise Mission Assurance Support Service (eMASS).
• Administer and track applicable systems and enclaves within eMASS and ensure ATO packages remain current.
• Maintain compliance with applicable cybersecurity standards and directives, including NIST SP 800-53 Revision 5, CNSSI 1253 Revision 4, DoDI 8510.01, and other applicable RMF requirements.
• Advise senior management and the Authorizing Official regarding cybersecurity risks, security posture, vulnerabilities, and changes affecting the organization's cybersecurity environment.
• Assess threats and vulnerabilities affecting computer systems and enclaves and develop appropriate security risk profiles.
• Conduct technical and non-technical risk and vulnerability assessments and identify, document, and support mitigation of cybersecurity vulnerabilities.
• Collect and maintain cybersecurity data required for system and enclave reporting.
• Maintain digital eMASS system package repositories on authorized information systems.
• Develop, maintain, and distribute cybersecurity plans, instructions, and Standard Operating Procedures (SOPs), including:
  • System Security Plans (SSPs)
  • Security Assessment Reports (SARs)
  • Plans of Action and Milestones (POA&Ms)
  • Risk assessment reports
  • Body of Evidence documentation
  • Network topology diagrams
  • Hardware inventories
  • Software inventories
• Ensure remediation plans and POA&Ms are established for vulnerabilities identified through assessments, audits, and inspections.
• Maintain ATO/eMASS artifacts and ensure required documentation is updated within established timelines.
• Maintain system hardening checklists and Security Technical Implementation Guides (STIGs) and coordinate remediation actions for cybersecurity findings.
• Support cybersecurity inspections and audits conducted by internal and external Government organizations.
• Coordinate with the TSRL IT lead to implement, assess, manage, and monitor eMASS security controls and assessment procedures.
• Utilize Assured Compliance Assessment Solution (ACAS) or other Air Force-approved scanning tools to identify and assess vulnerabilities.
• Conduct application vulnerability assessments and evaluate technical and non-technical risks associated with relevant technologies, applications, and software.
• Support Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance activities.
• Apply cybersecurity strategies and requirements to cloud computing services and deployment models.
• Ensure required cybersecurity training is completed by TSRL users requiring continued network access.
• Manage logical system access onboarding and offboarding processes, including maintaining SOPs for the submission and routing of DD Form 2875s.
• Serve as a central coordinator for organizational accounts and access requirements.
• Schedule and complete quarterly media destruction in accordance with applicable Air Force and local policies.
• Attend cybersecurity-related meetings and provide meeting minutes and supporting documentation as required for RMF compliance.
• Participate in system discovery and unit discussions to categorize systems for entry into eMASS.
• Assist with engineering compliant cybersecurity solutions and developing organizational security policies.
• Support hardware and software entry and exit requirements in accordance with applicable policies.
• Assist with managing TSRL Memorandums of Agreement (MOAs), Memorandums of Understanding (MOUs), and Acknowledgement of Responsibility (AOR) Letters associated with the RMF accreditation program.
• Assist with annual updates and periodic reviews of cybersecurity-related agreements and documentation.
• Transport classified equipment or media to approved destinations in accordance with applicable security regulations.
• Track and report DoD Directive 8140.03 certification requirements for applicable TSRL personnel.
• Participate in DoD 8140.03 meetings and teleconferences and assist with developing compliance metrics and briefings.
• Support the AFRL Cybersecurity Working Group (CSWG), including monthly meetings, roll call, meeting documentation, action-item tracking, and project coordination.
• Assist with developing cybersecurity processes, concepts of operation, implementation standards, policies, and related documentation.
• Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on science and technology-related IT and cybersecurity efforts and recommendations, as required.
• Provide customer service and cybersecurity support to unit personnel by answering questions and providing guidance regarding cybersecurity policies, processes, configurations, and implementation.
• Support AFRL Inspector General inspection activities, including pre- and post-inspection requirements.
• Support the research, selection, implementation, operation, metrics collection, and reporting of IT pilot and exploratory projects with potential enterprise-wide applicability.
• Support projects involving cybersecurity, server and desktop virtualization, collaborative systems, multi-platform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services.

Minimum Position Requirements

• Associate of Science degree in Information Technology, Cybersecurity, or a related field.
• Minimum of one (1) year of demonstrated experience working with Risk Management Framework (RMF) requirements and providing cybersecurity services, with no more than three consecutive years of lapse in cybersecurity work.
• Education, training, and/or certifications required by DoDM 8140.03 and applicable current Government directives, regulations, and policies for the assigned cybersecurity role.
• Current, valid Security+ certification.
• Intermediate-level cybersecurity work role experience.
• Ability to execute and maintain a Non-Disclosure Agreement (NDA) due to potential access to confidential, proprietary, and/or sensitive information.

Highly Desired Qualifications

• Current Secret security clearance.
• Experience supporting DoD or Air Force cybersecurity programs.
• Experience with RMF, ATO management, eMASS, STIGs, ACAS, vulnerability assessments, and cybersecurity remediation.
• Experience supporting Government cybersecurity audits, inspections, and compliance activities.
• Experience working in classified or sensitive information system environments.

SierTeK is an equal opportunity employer. Employment is decided based on qualifications, merit, and business need. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected Veteran status, gender identity and sexual orientation.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, transfer, leaves of absence, compensation, and training.

If you need assistance or accommodation due to a disability, you may contact us at 1+833.743.7835.

*This job posting is to identify potential candidates for positions in order to respond to a request for proposal. This job posting, including but not limited to, qualifications, duties, compensation and benefits, is subject to change based on the terms and conditions of the awarded contract and is contingent on SierTeK being awarded the contract.