Information Systems Security Officer

DAF Financial Management (FM) Enterprise Cybersecurity and Systems/FMWorkFlow Engineering Support

The ISSO provides day-to-day RMF, authorization, vulnerability-management, compliance-engineering, and cybersecurity documentation support for assigned systems within the DAF FM Authorizing Official boundary. The role maintains authorization artifacts in eMASS and ITIPS, supports vulnerability and risk analysis, coordinates remediation, contributes to AO decision support, and maintains accurate, audit-ready cybersecurity records for Government review.

Essential Duties & Responsibilities

• Support the full RMF lifecycle for assigned systems within the DAF FM AO boundary, including security control selection, implementation, validation, assessment support, authorization, and continuous monitoring.
• Develop, update, manage, and sustain authorization artifacts, including SSPs, RARs, POA&Ms, control evidence, and supporting RMF documentation in eMASS and ITIPS.
• Support vulnerability assessments, risk analysis, mitigation-strategy development, and remediation tracking for assigned systems.
• Coordinate remediation activities with system owners, Program Management Offices, systems administrators, database teams, cybersecurity leadership, and other technical stakeholders.
• Track and report vulnerability trends, remediation status, POA&M progress, overdue items, and risk conditions for assigned systems.
• Support preparation of A&A Decision Staff Packages, including risk analysis, control summaries, mission-impact information, and documentation supporting ATO, ATO with Conditions, or Denial recommendations.
• Support AO/AODR decision activities, including Mission Impact Assessments and authorization-decision briefing materials.
• Facilitate communication among system owners, security personnel, Program Offices, and cybersecurity leadership to resolve information-assurance issues.
• Support security-control assessments and document findings, gaps, weaknesses, associated risk levels, and recommended remediation strategies.
• Support maintenance of the FM Systems Inventory & Boundary Document, including authorization status, ATO expiration dates, and key points of contact for assigned systems.
• Support development and updates of FM-level cybersecurity policies, SOPs, templates, checklists, and implementation guidance.
• Prepare cybersecurity status information and support FM leadership briefings, working groups, governance forums, and the Annual Program Review as assigned.
• Coordinate cybersecurity requirements with configuration/change-management activities and technical teams when system modifications affect security controls, vulnerabilities, or authorization artifacts.
• Maintain accurate, current, traceable, and audit-ready cybersecurity records and artifacts suitable for Government review and QASP surveillance.

Security, Access & Compliance Responsibilities

• Comply with applicable Air Force Instructions, Air Force System Security Instructions, Air Force System Security Memorandums, and Government cybersecurity requirements.
• Complete Air Force-mandated Information Assurance Awareness Training before access to Government computing resources.
• Complete and maintain required DD Form 2875 System Authorization Access Request documentation for applicable EAFB/WPAFB network access.
• Obtain and properly display required CAC, Restricted Area Badge, contractor identification, or other installation credentials as applicable.
• Protect Personally Identifiable Information (PII) in accordance with NIST SP 800-122 and comply with Privacy Act requirements.
• Complete the required Contractor Employee Non-Disclosure Agreement.
• Immediately report known or suspected security violations or incidents to the FMWF PMO and assist Government security-related inquiries or investigations as directed.
• Use Government systems, networks, connectivity, email, servers, Internet access, and GFE only for authorized Government official business and acknowledge applicable monitoring requirements.
• Support COOP activities requested by the PMO when cybersecurity/RMF participation is required.

Recommended Technical Knowledge

• Working knowledge of DoD RMF, eMASS, ITIPS, SSPs, RARs, POA&Ms, continuous monitoring, security-control assessment, vulnerability management, and authorization lifecycle support.
• Experience with NIST SP 800-53, DoDI 8510.01, DoDI 8500.01, CNSSI 1253, FIPS 199, DISA STIG/SRG processes, vulnerability scanning, and secure Windows/Linux environments is strongly preferred where applicable.
• Strong technical writing, documentation, audit-readiness, risk-analysis, and cross-functional coordination skills.
• Experience supporting Air Force, DoD FM, ERP, financial, mission, or enterprise business systems is preferred.

Equal Employment Opportunity

We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable law.