GovCIO is currently seeking a highly motivated and experienced Information Systems Security Officer (ISSO) to support the 616 Operations Center (OC) and 616 Air and Space Communications Squadron (ACOMS). The position serves as Lead ISSO and Alternate Information Systems Security Manager (ISSM) for 616 ACOMS/SCXS, providing leadership with an accurate assessment of information system security across multiple domains. This position is located in San Antonio, Texas, and requires onsite work.
ResponsibilitiesManages information assurance (IA), cybersecurity compliance, system authorization, and continuous monitoring activities for mission information systems. Applies the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) to maintain security authorizations, assess vulnerabilities, evaluate system changes, and document security controls. Leads incident response coordination, supports inspections, develops local security procedures, and communicates operational risk and corrective actions to government leadership.
- Serve as Lead ISSO and Alternate ISSM for 616 ACOMS/SCXS. Present accurate security posture, authorization status, vulnerabilities, and operational risks for systems owned and maintained by the 616 OC and 616 ACOMS.
- Maintain Authorizations to Operate (ATOs) and Authorizations to Connect (ATCs) for six information systems across multiple impact levels and domains using the NIST RMF authorization process.
- Develop and maintain RMF authorization packages in the Enterprise Mission Assurance Support Service (eMASS) and Xacta. Document security control implementation, supporting evidence, and system-specific Concepts of Operations (CONOPS) for each package.
- Coordinate with Air Force Information Network (AFIN) Authorizing Officials (AOs) to obtain ATCs for guest RMF packages through applicable reciprocity processes.
- Lead incident response coordination; triage security events and analyze data to determine scope, attack vector, and operational impact. Coordinate authorized isolation of affected systems, threat removal, root-cause remediation, recovery, and sanitization or mitigation as directed by designated Air Force IC and Sixteenth Air Force authorities.
- Report incident status through established reporting chains to leadership and designated security, command, and communications organizations. Maintain incident documentation and track response actions through resolution.
- Identify applicable Security Technical Implementation Guide (STIG) baselines, ensure their implementation across enclave baselines, and document noncompliance in Plans of Action and Milestones (POA&Ms).
- Request Assured Compliance Assessment Solution (ACAS) vulnerability scans across each enclave. Analyze scan data to identify operational impact, coordinate mitigation, and determine current Weighted Vulnerability Index (WVI) scores against the applicable Command Cyber Readiness Inspection (CCRI) scorecard.
- Track and respond to Information Assurance Vulnerability Alerts (IAVAs), applicable orders, and IA tasking orders (TASKORDs). Coordinate required corrective actions, meet specified compliance dates, and report status.
- Apply system auditing fundamentals to review audit requirements, support audit log review and analysis, and identify security events or compliance deficiencies.
- Maintain hardware and software baselines, including version information. Evaluate proposed changes for new vulnerabilities, threats, and changes to the overall operational risk posture.
- Prepare Security Impact Analyses (SIAs) for hardware or software additions and removals, major software version upgrades, changes to Ports, Protocols, and Services (PPS), and virtualization environment changes. Submit change requests to the AO through established approval processes.
- Submit software source code for approval through the Air Force Intelligence Community Software Evaluation Process and the National Geospatial-Intelligence Agency (NGA) software approval process, as applicable.
- Develop local policies and standard operating procedures (SOPs) tailored to site-specific systems, roles, and constraints. When tasked, analyze and interpret IA policy and provide written determinations with supporting guidance and references.
- Prepare and review IA pre-inspection checklists; document compliant and noncompliant items; and develop, submit, and track POA&Ms for deficient security controls, including required entries in Dispatch.
- Conduct quarterly privileged-user access validation. Review access authorization documentation and coordinate required updates through the DD Form 2875, System Authorization Access Request, process.
- Coordinate with system administrators, system owners, government security officials, and leadership to maintain authorization evidence, implement approved corrective actions, and sustain an accurate representation of system security posture.
QualificationsHigh School with 9+ years (or commensurate experience)
Required Skills and Experience
- Clearance Required: TS/SCI with NATO Secret
- Current baseline certification appropriate to assigned Information Assurance Management (IAM) duties in accordance with applicable Department of Defense (DoD) 8140 qualification requirements.
- Solid working knowledge of the RMF process and demonstrated experience successfully obtaining ATOs for information systems.
Solid working knowledge of eMASS, including authorization package maintenance, security control documentation, and supporting evidence. - Sound knowledge and practical experience in security event triage, incident scope and impact analysis, containment, threat removal, root-cause remediation, and reporting through established chains.
- Experience identifying and implementing STIG baselines, analyzing ACAS results, assessing CCRI and WVI metrics, documenting POA&Ms, and responding to IAVAs and IA orders within required timelines.
- Working knowledge of system auditing fundamentals, hardware and software baseline management, security impact analysis, and AO change approval processes.
- Ability to develop local security policies and SOPs and provide written policy interpretations supported by applicable references.
- Experience preparing for IA inspections, documenting compliance findings, and developing corrective action plans.
- Working knowledge of quarterly privileged-user access validation and the DD Form 2875 process.
- Ability to communicate security posture and operational risk to leadership, maintain accurate technical documentation, coordinate across organizations, and prioritize concurrent security requirements.
- Current baseline certification, education, and/or training appropriate to assigned Information Assurance Management (IAM) duties in accordance with applicable Department of Defense (DoD) 8140 qualification requirements- Intermediate (722) (as listed below):
- Applicable Certification: CCISO - Certified Chief Information Security Officer; CCSP - Certified Cloud Security Professional; CGRC/CAP - Certified in Governance, Risk, and Compliance (Formerly known as CAP); CISSO - Certified Information Systems Security Officer; Cloud+ - CompTIA Cloud plus; GCSA - GIAC Cloud Security Automation; GMON - GIAC Continuous Monitoring; GSEC - GIAC Security Essentials Certification; Security+ - CompTIA Security plus; SecurityX / CASP+ - CompTIA SecurityX (Formerly known as Advanced Security Practitioner plus [CASP+]); SSCP - Systems Security Certified Practitioner; GICSP - Global Industrial Cyber Security Professional; GSLC - GIAC Security Leadership Certification.
- Applicable Education: Bachelors - Computer Science; Bachelors - Cybersecurity; Bachelors - Data Science; Bachelors - Information Systems; Bachelors - Information Technology; Bachelors - Other Associated Degree Discipline; Bachelors - Software Engineering
- Applicable Training: 531-25B40-C46 - Information Technology Specialist SLC; Information Systems Security Manager (Intermediate) Credential - Information Systems Security Manager (Intermediate) Playlist; M09BNJ1 - Cybersecurity Technician; M09LC51 - Basic Communications Officer Course (BCOC)
Preferred Skills and Experience
- Solid working knowledge of Xacta.
- IA experience within the Intelligence Community (IC).
- Certified Information Systems Security Professional (CISSP) certification.
- College degree in cybersecurity, information systems, computer science, or a related field.
- Experience serving as a Lead ISSO or Alternate ISSM and managing authorization packages across multiple domains and impact levels.
- Experience with AFIN reciprocity and ATC coordination, Dispatch, and Air Force IC or NGA software approval workflows.
#nss
#dl #tlm
Posted Salary RangeUSD $95,000.00 - USD $130,000.00 /Yr.
