Information System Security Engineer (ISSE)

Interactive Process Technology LLC•Bath Township, OH

2d•Onsite

About The Position

IPT Associates is seeking an Information System Security Engineer (ISSE) for a position at Wright-Patterson AFB. The role supports information-system security engineering, Risk Management Framework (RMF) activities, authorization, security assessments, continuous monitoring, and cybersecurity risk management for AFRL Science and Technology systems. The position is contingent upon contract award, and the actual duties may vary based on contract requirements and organizational needs. The engineer will apply DoD, Department of the Air Force, AFRL, NIST, and CNSSI guidance throughout the system lifecycle; maintain authorization documentation; assess security controls and vulnerabilities; and provide technically supported findings and recommendations to Authorizing Officials and other stakeholders. The role also involves collaboration with system owners, program managers, cybersecurity personnel, engineers, and developers, as well as incident-response support and assessment of systems against Zero Trust guidance. The position supports multi-level security capabilities up to Top Secret/Sensitive Compartmented Information.

Requirements

Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field.
Five or more years of experience in information system security engineering, cybersecurity engineering, RMF, or assessment and authorization.
Knowledge of NIST SP 800-160, 800-37, 800-53, and 800-53A; CNSSI 1253; DoDI 8510.01; and applicable Air Force cybersecurity policy.
Experience analyzing security requirements and architectures and implementing, assessing, testing, and validating security controls.
Experience developing and maintaining RMF authorization artifacts, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, authorization boundaries, inventories, system diagrams, and supporting evidence.
Ability to assess vulnerabilities, architectural and residual risk, and control effectiveness and provide actionable recommendations to cybersecurity decision-makers.
Knowledge of Security Technical Implementation Guides, vulnerability and configuration assessment, audit-log review, continuous monitoring, and remediation validation.
Experience with eMASS, Xacta, or comparable governance, risk, compliance, or authorization-management platforms.
Experience interpreting results from vulnerability-management, compliance, security information and event management, software-security, or container-security tools.
Strong collaboration, technical writing, analysis, briefing, and communication skills.
DoD-approved cyberspace workforce qualification and operating-system certification required for assigned duties under DoDM 8140.03.
Ability to meet applicable privileged-user authorization requirements when assigned privileged access.
Active Secret clearance and eligibility to obtain and maintain Top Secret/Sensitive Compartmented Information access when required.

Nice To Haves

CISSP, CISM, CGRC, or an equivalent advanced cybersecurity certification.

Responsibilities

Assess information systems, architectures, and proposed changes for vulnerabilities, control deficiencies, authorization risk, and impacts to the AFRL Science and Technology authorization boundary; advise the Authorizing Official on required improvements.
Apply system security engineering principles and applicable DoD, Department of the Air Force, AFRL, NIST, and CNSSI standards throughout the system lifecycle.
Support all Risk Management Framework phases, including categorization, control selection and implementation, assessment, authorization, and continuous monitoring.
Develop and maintain authorization artifacts, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, authorization boundaries, inventories, ports, protocols and services documentation, system diagrams, and supporting evidence.
Conduct security control assessments using vulnerability and configuration scans, documentation and audit-log reviews, security testing, and penetration testing when required.
Implement and validate Security Technical Implementation Guides; analyze vulnerability, compliance, source-code, dependency, and container-security results; recommend remediation; and verify corrective actions.
Develop and track Plans of Action and Milestones through closure and maintain current authorization evidence through continuous monitoring.
Support eMASS and Xacta workflows and use security information and event management, vulnerability-management, compliance, and authorization platforms to assess and report system status.
Provide technically supported findings, risk recommendations, and authorization-status updates to the Authorizing Official, designated representatives, Security Control Assessor, and other stakeholders.
Collaborate with system owners, program managers, cybersecurity personnel, engineers, and developers to integrate security into system design and operations.
Support incident response, including affected-system analysis, corrective-action coordination, and reporting through Government channels.
Support multi-level security capabilities up to Top Secret/Sensitive Compartmented Information and assess systems against DoD and Department of the Air Force Zero Trust guidance.