Information Systems Security Officer

Capefox•San Antonio, TX

About The Position

Cape Fox Federal Integrators (CFFI), a Cape Fox subsidiary, seeks an Information System Security Officer (ISSO) to provide cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone systems and enclaves for a federal government client. The position supports Risk Management Framework (RMF) compliance, security control implementation, Authority to Operate (ATO) documentation, vulnerability management, continuous monitoring, and security assessments under applicable DoD policies and directives. The position is contingent upon contract award. The ISSO will advise technicians and senior leadership on cybersecurity requirements, risks, and solutions; maintain enterprise cybersecurity compliance, system authorizations, security documentation, and IT portfolio data; and support configuration management, audits, inspections, assessments, vulnerability scanning, remediation, and system hardening. The role also includes eMASS administration, access management, user training coordination, cybersecurity reporting, workforce development tracking, classified equipment and media handling, and participation in cybersecurity working groups and meetings. The ISSO will support technology pilot projects, evaluate enterprise IT initiatives, and collect metrics and prepare reports on project outcomes and cybersecurity benefits. This is an exempt position with a posted salary range of $95,000–$115,000. The position requires an associate degree in Information Technology or Cybersecurity, at least one year of RMF and cybersecurity services experience, a current Security Plus certification, intermediate-level Cybersecurity Work Role experience, and a current Secret clearance. The candidate must also be authorized to work in the United States. Cape Fox Corporation and its affiliates provide equal employment opportunities and offer preference to Cape Fox Corporation Shareholders, descendants, and other Native Americans pursuant to Public Law 100-241.

Requirements

Associate of Science degree in Information Technology or Cybersecurity, demonstrated by a copy of the degree.
At least one year of demonstrated experience working with RMF requirements and providing cybersecurity services.
Current, valid Security Plus certification.
Required Information Technology or Cybersecurity education, training, or certifications under DoDM 8140.03 and current Government directives, regulations, and policies for the role or labor category.
Intermediate-level Cybersecurity Work Role experience.
Current Secret clearance.
Authorization to work in the United States as defined by the Immigration Reform Act of 1986.

Responsibilities

Provide ISSO cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone systems and enclaves.
Advise unit technicians on cybersecurity requirements, solutions, and implementation.
Administer, coordinate, and track compliance with enterprise cybersecurity architecture, strategy, plans, and policies across the distributed AFRL organization.
Ensure RMF compliance, maintain valid ATOs, keep security documentation current, and provide cybersecurity expertise to supported units.
Review configuration management processes, maintain secure mechanisms, update RMF requirements, and support internal and external audits and inspections.
Maintain IT portfolio data and database structures in ITIPS, RMF Workflow, and eMASS.
Maintain ATOs for TSRL and related subsystems in accordance with applicable security standards, directives, and RMF requirements.
Advise senior management and the Authorizing Official on risk levels, security posture, and cybersecurity-affecting changes.
Assess system and enclave threats, vulnerabilities, and technical risks; document findings and recommend mitigations.
Collect and maintain cybersecurity reporting data and manage the digital eMASS system package repository on authorized information systems.
Track systems and enclaves in eMASS, maintain current ATOs, and manage security controls and assessment procedures in coordination with the TSRL IT lead while preventing accidental overwriting of other team members’ data.
Develop, distribute, and maintain security plans, instructions, SOPs, Body of Evidence documents, System Security Plans, SARs, POA&Ms, risk assessments, topology diagrams, and hardware/software inventories.
Establish and track remediation plans for vulnerabilities identified through risk assessments, audits, and inspections.
Maintain ATO/eMASS artifacts for semiannual inspection and upload changes to required ATO documentation into eMASS within three business days.
Maintain STIG checklists and implement documented remediation actions for audit and inspection findings.
Support internal and external Government cybersecurity audits, inspections, and assessments.
Use ACAS or other Air Force-approved scanning tools to evaluate scan results and identify vulnerabilities.
Conduct application vulnerability assessments and technical and nontechnical risk assessments across relevant technologies, applications, and software.
Implement IAVM dissemination, reporting, and compliance procedures.
Apply cybersecurity strategies to cloud service and deployment models and ensure TSRL users complete required cybersecurity training for continued network access.
Maintain onboarding and offboarding SOPs, manage DD Form 2875 submission and routing, and coordinate organizational user accounts.
Schedule and complete quarterly media destruction in accordance with Air Force and local policies.
Attend required in-person or virtual cybersecurity meetings and document meeting minutes supporting RMF requirements.
Support system discovery, categorize systems for eMASS entry, develop compliant cybersecurity solutions and organizational security policies, and assist with hardware and software entry/exit requirements.
Maintain TSRL MOAs, MOUs, and AOR letters; update them annually and conduct full reviews every three years.
Transport classified equipment and media to approved TSRL destinations in accordance with applicable security regulations.
Track and report certification requirements for applicable TSRL personnel and participate in DoD 8140.03 teleconferences and meetings as required.
Coordinate with the Government lead to develop compliance metrics and briefings.
Support the CSWG and participate in monthly video teleconferences; conduct roll calls, record minutes, track action items, and facilitate projects.
Gather requirements and help develop processes, concepts of operations, implementation standards, and cybersecurity policies.
Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on S&T IT and cybersecurity initiatives and recommendations.
Respond to user questions regarding cybersecurity and related technical topics; explain processes, policies, and requirements; and recommend secure configurations and implementation approaches.
Support the Inspection Functional Lead for the Communications functional area during pre-inspection and post-inspection activities.
Support research, selection, implementation, and operation of IT pilot and exploratory projects with enterprise-wide applicability.
Support initiatives involving cybersecurity, server and desktop virtualization, collaborative systems, multiplatform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services.
Collect metrics and prepare reports assessing project outcomes, efficiency, capability improvements, and cybersecurity benefits.