Information System Security Officer (ISSO)

Sawdey Solution Services; Patterson Township (OH); Hybrid; USD 110,000 - 145,000; Full time

Job summary

Sawdey Solution Services, Inc. is seeking a Cybersecurity ISSO to manage RMF activities and ensure compliance for classified and cross-domain environments at the Secret level and below.

The role oversees day-to-day cybersecurity operations, creates and updates security artifacts, and coordinates with ISSM/AO to obtain IATT/ATO approvals. The ISSO will perform vulnerability scans, STIG reviews, and support NCCRMF documentation using eMASS, Xacta, and other tools.

Qualifications

• Experience performing ISSO, cybersecurity, RMF support duties.
• Familiar with cross-domain solutions and RMF processes.
• Ability to prepare RMF artifacts and explain findings.

Responsibilities

• Serve as ISSO for one or more information systems or CDS networks.
• Support RMF activities including assessment, documentation, and testing of security controls.
• Maintain RMF artifacts in eMASS, Xacta, or equivalent tools.

Skills

Cross domain solutions

RMF knowledge

ISSO duties

Security documentation

Education

8570 IAT Level II/III

Tools

eMASS

Xacta

ACAS

Job description

Pay Rate
The annual base salary range for this position TBD. Please note that the salary information is a general guideline only. At Sawdey Solution Services, we recognize that attracting the best talent is key to our strategy and success as a company. We will consider several factors when extending an offer to an applicant. These factors include (but are not limited to) the position, associated responsibilities, work experience, education, related training, and related skills.

Position Location: Wright-Patterson Air Force Base

Telework/Work-from-Home Authorized Yes - When Authorized/Hybrid

About the Role: The Cybersecurity/Information System Security Officer (ISSO) will provide Cross Domain Solutions (CDS) Network Architect Certification and Accreditation (C&A) support and oversee day-to-day cybersecurity operations and Risk Management Framework (RMF) activities for assigned information systems, including classified and cross-domain environments at the Secret level and below. Responsibilities include ensuring compliance with DoDI 8510.01, Risk Management Framework for DoD Information Technology, AFI 17-101, Risk Management Framework for Air Force Information Technology, and applicable Air Force Research Laboratory (AFRL) RMF guidance and policies. The ISSO will support the implementation, documentation, assessment, and testing of applicable Information Assurance (IA) security controls; develop and maintain required security artifacts, including network topology diagrams, hardware and software inventories, ports and protocols lists, and Plans of Action and Milestones (POA&Ms); conduct and support vulnerability assessments and Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) compliance reviews; track and coordinate remediation activities; and support Interim Authorization to Test (IATT) and Authorization to Operate (ATO) processes in coordination with the Information System Security Manager (ISSM), Authorizing Official (AO), and other system stakeholders.

Additional Responsibilities Include, But Are Not Limited To

• Serve as the assigned Information System Security Officer (ISSO) for one or more information systems, networks, laboratories, flight-test environments, or Cross Domain Solutions (CDS), including classified and Secret-and-below environments and, when assigned, SCI environments.
• Support the implementation, documentation, assessment, and testing of applicable security controls in accordance with the Risk Management Framework (RMF).
• Develop, update, and maintain RMF documentation and security artifacts in eMASS, Xacta, EBS, or other customer-designated systems, including:
• System Security Plans (SSPs) and Security Assessment Reports (SARs).
• Plans of Action and Milestones (POA&Ms) and security control implementation statements.
• Network architecture and topology diagrams.
• Hardware and software inventories.
• Ports, protocols, and services documentation.
• Supporting security assessment evidence and compliance records.
• Conduct and coordinate vulnerability scans, Assured Compliance Assessment Solution (ACAS) reviews, and Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) assessments. Analyze findings, assess potential impacts, and recommend corrective actions to mitigate identified risks.
• Track remediation activities, security control deficiencies, and POA&M milestones, escalating unresolved risks and overdue actions to the Information System Security Manager (ISSM).
• Support Interim Authorization to Test (IATT), Authorization to Operate (ATO), reauthorization, continuous monitoring, and customer inspections, ensuring required security documentation and supporting evidence are complete and current.
• Collaborate with system owners, program managers, engineers, network architects, and cybersecurity personnel to maintain system security compliance and address RMF requirements throughout the system lifecycle.
• Support security assessments of cross-domain technologies, including guards, diodes, and associated network interfaces, to ensure secure information exchange between systems operating at different classification levels.
• Work closely with the RYZT Combat ID, Blue Guardian, Test, and RYSIL teams to develop and implement cross-domain security solutions that:
• Enable the secure integration of Top Secret, Secret, and unclassified data into consolidated products supporting flight tests and demonstrations.
• Facilitate multi-sensor data fusion, integration, and testing through a common data bus within systems integration laboratories and aircraft-mounted sensor pods.
• Support the development of data repositories for storing, accessing, and developing multi-level sensor models and associated data.
• Identify network architecture and infrastructure requirements supporting the RY digital strategy, including connectivity to other RY networks and associated hardware, such as guards and diodes.
• Support the preparation of RMF documentation required to obtain IATTs and ATOs for laboratory, flight, and field testing.
• Assist with proposal development, as required.
• Perform other duties as assigned.

Experience Requirements

• Technical knowledge of cross domain solutions and work hand in hand with their engineers to develop one.
• Familiar with DoD and AF guidance on Security in general and Cybersecurity in particular.
• Awareness of DISA STIGs, ACAS vulnerability scanner, and AF Ports, Protocols, and Services process.
• Familiar with the Risk Management Framework process (NIPR/SIPR eMASS, AFRL process).
• Possibly XACTA as well if will be involved in RMF for TS/SCI.
• Technical understanding to be able to discuss computer/network issues.
• Familiar with AF TEMPEST policies and process.

Certificate, License, and Registration Requirements: Current DoD 8570 IAT Level II or III certification.

• Security + CE
• SSCP
• GSEC
• CISSP
• CISA
• CASP

Other Required Skills & Abilities

• Experience performing ISSO, cybersecurity, information assurance, or RMF support duties.
• Working knowledge of DoDI 8510.01, AFI 17-101, applicable AFRL guidance, and customer-specific RMF procedures.
• Experience with eMASS, Xacta, or comparable RMF workflow tools.
• Experience with DISA STIGs, ACAS or comparable vulnerability scanning, and POA&M management.
• Ability to prepare and maintain RMF artifacts and explain security findings to technical and nontechnical stakeholders.
• Must be able to effectively communicate with customer and fulfill all duties and responsibilities as listed in the contract.
• Must be proficient in Microsoft Office suite including, but not limited to: Word, PowerPoint, Excel, and Outlook.

Security Clearance Requirements: Top Secret/SCI Clearance.

US Citizenship Requirements This position supports a U.S. Government Contract whose terms require Sawdey Solution Services to staff it only with U.S. Citizens.