USAF - Information Systems Security Officer (ISSO)

• Active TS/SCI SSBI clearance
• B.S. Computer Science, Information Technology, or a related field
• 6+ years of RMF/Cybersecurity experience
• Demonstrated experience performing ISSO, RMF, Assessment and Authorization, or security-compliance duties for federal or DoD information systems.
• Working knowledge of the full RMF lifecycle, security controls, control assessment, authorization decisions, ongoing authorization, and continuous monitoring.
• Experience developing and maintaining SSPs, RARs, POA&Ms, assessment findings, implementation evidence, inventories, and system authorization packages.
• Hands-on proficiency with eMASS and ITIPS or comparable federal authorization-management systems.
• Experience conducting vulnerability analysis, documenting risk, developing remediation plans, tracking corrective action, and validating closure evidence.
• Ability to interpret federal, DoD, and Air Force cybersecurity requirements and apply them consistently to assigned systems.
• Ability to assess security-control evidence, identify gaps or weaknesses, determine risk implications, and recommend practical corrective actions.
• Strong analytical, technical-writing, briefing, stakeholder-coordination, quality-control, and records-management skills.
• Ability to manage multiple systems, authorization actions, recurring reports, and deadlines while maintaining artifact currency and accuracy.
• Active DoD 8570 IAM Level III and DoD 8140 System Administrator certification

• Execute and coordinate RMF lifecycle activities for assigned systems, including security categorization support, control selection, implementation, validation, authorization, and continuous monitoring.
• Apply federal, DoD, and Air Force cybersecurity policies and translate applicable requirements into system-specific implementation and evidence needs.
• Develop, update, review, and sustain authorization artifacts, including SSPs, RARs, POA&Ms, control implementation statements, assessment evidence, inventories, diagrams, and related documentation.
• Maintain complete and accurate authorization records in eMASS and ITIPS, including status, evidence, findings, milestones, and ATO expiration information.
• Coordinate security-control implementation and evidence collection with system owners, engineers, developers, database administrators, system administrators, and program offices.
• Review security controls and evidence for completeness, effectiveness, currency, consistency, and traceability; document gaps and coordinate corrective action.
• Conduct or support vulnerability assessments, risk analysis, mitigation planning, remediation tracking, validation, and residual-risk documentation.
• Create and manage POA&Ms; monitor milestones, overdue items, closure evidence, risk acceptance, and escalation conditions.
• Track and report system and portfolio vulnerability trends, remediation status, authorization health, and continuous-monitoring results.
• Prepare security-control assessment findings reports identifying weaknesses, risk levels, mission impacts, and recommended remediation strategies.
• Support preparation and quality review of authorization decision staff packages, including risk analysis, control summaries, mission impact, and recommendations for ATO, ATO with Conditions, or Denial.
• Facilitate communication among system owners, cybersecurity personnel, program offices, the ISSM, and the FM AO to resolve information-assurance issues.
• Prepare status updates, policy and guidance inputs, AO decision-support materials, and leadership briefings; participate in governance forums and technical reviews.
• Maintain system inventory and authorization-boundary information, including key points of contact, authorization status, and expiration dates.
• Evaluate cybersecurity impacts of system modifications, configuration changes, patches, updates, and production deployments; support technical validation and readiness decisions.
• Apply technical documentation governance, version control, quality control, and records traceability to all assigned work products.
• Support COOP, disaster recovery, contingency, incident, and mission-continuity activities requested by the PMO.