Information Systems Security Officer

Cape Fox Federal Contracting Group; San Antonio (TX); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

Tuition reimbursement

401K with company match

Paid time off

Job summary

Cape Fox Corporation, via its Cape Fox Federal Integrators (CFFI), is seeking an Information Systems Security Officer (ISSO) to support RMF, ATO, and vulnerability management across NIPRNet, SIPRNet, DREN, RDTE, and standalone enclaves for a federal client. The role requires coordinating security controls, assessments, and documentation in accordance with DoD directives.

Responsibilities include advising on cybersecurity requirements, maintaining eMASS and STIGs, and producing security artifacts

Qualifications

• Minimum one Associate degree in IT or Cybersecurity.
• Experience with RMF requirements and cybersecurity services.
• Current Security Plus certification.

Responsibilities

• Provide ISSO support for RMF, ATO, and security documentation.
• Advise on cybersecurity requirements and implementations.
• Maintain eMASS, STIG checklists, and security artifacts.
• Coordinate audits, risk assessments, and remediation actions.
• Support DoD 8140/RMF compliance and related programs.

Skills

RMF experience

Cybersecurity knowledge

Risk management

Education

Associate of Science in IT or Cybersecurity

Tools

eMASS

STIGs

NIST SP 800-53

CNSSI 1253

Job description

Information Systems Security Officer - (9147)

Job Title

Information Systems Security Officer

Job Description

Cape Fox subsidiary, Cape Fox Federal Integrators (CFFI), is seeking a highly qualified and motivated Information System Security Officer (ISSO) to provide cybersecurity support for Non-classified Internet Protocol Router Network (NIPRNet), Defense Research and Engineering Network (DREN), Research, Development, Test, and Evaluation (RDTE), Secret Internet Protocol Router Network (SIPRNet), and standalone systems and enclaves for a federal government client. The ISSO will support Risk Management Framework (RMF) compliance, security control implementation, Authorization to Operate (ATO) documentation, vulnerability management, continuous monitoring, and security assessments in accordance with applicable DoD policies and directives. This position is contingent upon contract award.

The above salary range represents the company’s good faith and reasonable estimate of the range of possible compensation at the time of posting. In addition, we offer a variety of benefits, including company holidays, paid time off, health insurance, dental insurance, vision insurance, life and disability insurance, tuition reimbursement, as well as a 401K with company match. This job will be posted until filled or withdrawn.

Core Duties:

• Provide Information Systems Security Officer (ISSO), 8140 Cyberwarfare Code of 721 cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems
• Cybersecurity Consultation: Advise unit technicians on cybersecurity requirements, solutions, and implementation
• Enterprise Cybersecurity Compliance: Administer, coordinate, and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, and policies across the distributed AFRL organization
• RMF and ATO Management: Ensure Risk Management Framework (RMF) compliance, maintain valid Authority to Operate (ATO), keep security documentation current, and provide cybersecurity expertise to supported units
• Configuration Management: Review configuration management processes, maintain secure mechanisms, update RMF requirements, and support internal and external audits and inspections
• IT Portfolio and Database Management: Maintain Information Technology (IT) portfolio data and database structures in the Information Technology Investment Portfolio System (ITIPS), RMF Workflow, and Enterprise Mission Assurance Support Service (eMASS)
• Security Standards and Authorization: Maintain ATOs for Tri-Service Research Laboratory (TSRL) and related subsystems in accordance with NIST SP 800-53 Rev. 5, CNSSI 1253 Rev. 4, DoDI 8510.01, DISAI 270-50-9, and applicable RMF directives
• Risk Advisory and Reporting: Advise senior management and the Authorizing Official on risk levels, security posture, and changes affecting organizational cybersecurity
• Threat and Vulnerability Assessments: Assess system and enclave threats, vulnerabilities, and technical risks; document findings and recommend mitigation measures
• Cybersecurity Reporting and Repository Management: Collect and maintain cybersecurity reporting data and manage the digital eMASS system package repository on authorized information systems
• eMASS Administration: Track systems and enclaves in eMASS, maintain current ATOs, and manage security controls and assessment procedures in coordination with the TSRL IT lead while preventing accidental overwriting of other team members’ data
• Security Documentation and SOPs: Develop, distribute, and maintain security plans, instructions, SOPs, Body of Evidence documents, System Security Plans, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), risk assessments, topology diagrams, and hardware/software inventories
• Remediation Management: Establish and track remediation plans for vulnerabilities identified through risk assessments, audits, and inspections
• ATO Artifact Maintenance: Maintain ATO/eMASS artifacts for semiannual inspection and upload changes to required ATO documentation into eMASS within three business days
• System Hardening: Maintain Security Technical Implementation Guide (STIG) checklists and implement documented remediation actions for audit and inspection findings
• Cybersecurity Audits and Inspections: Support internal and external Government cybersecurity audits, inspections, and assessments
• Vulnerability Scanning: Use Assured Compliance Assessment Solution (ACAS) or other Air Force-approved scanning tools to evaluate scan results and identify vulnerabilities
• Application Security: Conduct application vulnerability assessments and technical and nontechnical risk assessments across relevant technologies, applications, and software
• IAVM Compliance: Implement Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance procedures
• Cloud Security and User Training: Apply cybersecurity strategies to cloud service and deployment models and ensure TSRL users complete required cybersecurity training for continued network access
• Logical Access Management: Maintain onboarding and offboarding SOPs, manage DD Form 2875 submission and routing, and coordinate organizational user accounts
• Media Destruction: Schedule and complete quarterly media destruction in accordance with Air Force and local policies
• Cybersecurity Meetings: Attend required in-person or virtual cybersecurity meetings and document meeting minutes supporting RMF requirements
• System Discovery and Compliance Engineering: Support system discovery, categorize systems for eMASS entry, develop compliant cybersecurity solutions and organizational security policies, and assist with hardware and software entry/exit requirements
• Agreements and Classified Equipment: Maintain TSRL Memorandums of Agreement (MOAs), Memorandums of Understanding (MOUs), and Acknowledgment of Responsibility (AOR) letters; update them annually and conduct full reviews every three years. Transport classified equipment and media to approved TSRL destinations in accordance with applicable security regulations
• Workforce Development
• DoD 8140.03 Compliance: Track and report certification requirements for applicable TSRL personnel
• Workforce Coordination: Participate in DoD 8140.03 teleconferences and meetings as required
• Metrics and Briefings: Coordinate with the Government lead to develop compliance metrics and briefings
• Cybersecurity Working Group
• CSWG Participation: Support the Cybersecurity Working Group (CSWG) and participate in monthly video teleconferences.
• Meeting Administration: Conduct roll calls, record meeting minutes, track action items, and facilitate projects
• Requirements and Documentation: Gather requirements and help develop processes, concepts of operations, implementation standards, and cybersecurity policies
• Leadership Briefings: Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on science and technology (S&T) IT and cybersecurity initiatives and recommendations
• Customer Service
• User Support: Respond to user questions regarding cybersecurity and related technical topics
• Policy Interpretation: Explain cybersecurity processes, policies, and applicable requirements.
• Technical Guidance: Provide recommendations on secure cybersecurity configurations and implementation
• Inspector General (IG)
• Inspection Support: Support the Inspection Functional Lead (IFL) for the Communications functional area during pre-inspection and post-inspection activities
• Pilot Project Support: Support research, selection, implementation, and operation of IT pilot and exploratory projects with enterprise-wide applicability
• Technology Evaluation: Support initiatives involving cybersecurity, server and desktop virtualization, collaborative systems, multiplatform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services
• Performance Measurement: Collect metrics and prepare reports assessing project outcomes, efficiency, capability improvements, and cybersecurity benefits

Travel Requirements

0 - 10%

Job Requirements

Requirements :

• Must possess a minimum of an Associate of Science Degree in Information Technology or Cybersecurity, demonstrated by a copy of the degree
• Must have a minimum of one (1) year of demonstrated experience working Risk Management Framework (RMF) requirements and providing cybersecurity services
• Must have a current, valid Security Plus Certification
• Must possess the required Information Technology or Cybersecurity education, training, or certifications IAW DoDM 8140.03 and current Government directives, regulations, and policies for the role, or labor category, it is fulfilling (reference DFARS 252.239-7001)
• Must have Intermediate-level Cybersecurity Work Role experience
• Must possess a current Secret Clearance
• Must have authorization to work in the United States as defined by the Immigration Reform Act of 1986

Cape Fox Corporation, its subsidiaries, and affiliates provide equal employment opportunities to all persons and prohibit employment decisions on the basis of race, religion, color, creed, national origin, sex, age, disability, political affiliation, protected veteran status, or sexual orientation, or any other characteristic protected by federal, state, or local law. Cape Fox Corporation, its subsidiaries, and affiliates offer preference to Cape Fox Corporation Shareholders, descendants, and other Native Americans pursuant to Public Law 100-241.

Category

Science / Research

Location

San Antonio, TX - Lackland AFB, TX 78236 US (Primary)