SITEC - ISSO - MacDill AFB

Peraton•Tampa, FL

1d•$104,000 - $166,000•Onsite

About The Position

Peraton is hiring an Information Systems Security Officer (ISSO) to provide hands-on cybersecurity support for SOCOM systems at MacDill Air Force Base. The role supports the Special Operations Command Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance task order, which provides USSOCOM and its component and theater special operations commands with operations, systems and network infrastructure maintenance, end-user and common-device support, configuration and asset management, training, and IMAC services. The broader mission operates around the globe 24x7x365. The ISSO / RMF Analyst is responsible for protecting the security and integrity of federal and national-security information systems, managing risk, and supporting compliance with applicable regulations and standards. The position focuses on Risk Management Framework (RMF) lifecycle activities, continuous monitoring, vulnerability management, compliance reporting, and cybersecurity documentation. The role works with technical and non-technical stakeholders and supports IT risk and controls assessments, including assessment planning, evidence review, control testing, documentation, and remediation planning.

Requirements

Active DoW TS/SCI clearance.
At least 3 years of relevant experience in IT Risk Management, Information System Security, and/or Cybersecurity.
Minimum total experience requirement varies by education: 12 years with a high school diploma, 10 years with an AS/AA degree, 8 years with a BS/BA degree, 6 years with an MS/MA degree, or 3 years with a PhD.
Must be DoW 8140 compliant under Work Role Code 722 – Information Systems Security Manager – at Intermediate level or higher.
DoW 8570 IAT II certification or higher.
Extensive experience with the Risk Management Framework (RMF) process and NIST SP 800-53/800-37.
Experience creating and updating Security Assessment and Authorization (SA&A) artifacts, including FIPS 199, Contingency Plans, Contingency Plan Tests, and System Security Plans.
Knowledge and experience in IT risk and controls through IT audits, IT control assessments, and IT security reviews.
Working knowledge of FISMA, NIST SP 800 series, FISCAM, and other relevant federal information-assurance laws, regulations, and guidance.
Experience performing FISMA, OMB Circular A-123, or similar internal control assessments.
Understanding of security frameworks such as FedRAMP and DISA DCAS.
Understanding of the DoD Cloud Computing Security Requirements Guide and other DoD STIGs/SRGs, including experience with the STIG Viewer toolset.
Proficiency in eMASS.
Proficiency in Microsoft Excel, Word, and PowerPoint.

Responsibilities

Work with IT risk management assessors to conduct IT risk and controls assessments using government guidance and organizational policies and procedures.
Conduct walkthrough interviews and maintain communication with client stakeholders, including system and database administrators.
Request, obtain, review, and analyze artifacts used for IT controls testing, such as security plans, SOPs, screenshots, and system configuration settings.
Evaluate the design and operating effectiveness of IT controls using artifacts, industry guidance, leading practices, and professional judgment.
Document IT controls testing results consistently and clearly enough for reviewers to repeat the testing and reach the same conclusion.
Summarize and communicate IT controls assessment results to client stakeholders, including senior leadership.
Plan and execute day-to-day IT controls assessment activities individually and as part of a team.
Work with client personnel to understand control weaknesses, identify root causes, and develop detailed remediation plans.
Provide subject matter expertise on IT controls and respond to ad hoc requests from client personnel.
Implement and manage continuous monitoring programs to maintain ongoing information-system security.
Support RMF lifecycle activities, vulnerability management, compliance reporting, and cybersecurity documentation development for SOCOM systems.