Information System Security Manager (ISSM) (27.1)*

SierTeK proudly serves our clients by providing expertise in the Program Management, Information Technology, and Administrative Support domains. Founded in 2007 as a minority and service-disabled veteran-owned company, we serve as prime- and subcontractor for a multitude of Federal Department of Defense contracts. By focusing on continual improvement, our services remain at the forefront of our industry, and we pride ourselves on delivering our services with the highest degree of integrity.

SierTeK Ltd. is seeking an Information System Security Manager (ISSM) to support an opportunity at JBSA-Fort Sam Houston.

Position Overview Section

SierTeK is seeking an experienced Information System Security Manager (ISSM) to provide cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves and systems supporting Air Force Research Laboratory (AFRL) operations.

The ISSM will be responsible for managing and supporting cybersecurity activities across a distributed AFRL organization, with a strong focus on Risk Management Framework (RMF) compliance, Authorization to Operate (ATO) management, cybersecurity assessments, vulnerability management, eMASS administration, security documentation, and DoD cybersecurity workforce requirements.

The ideal candidate will have strong knowledge of DoD cybersecurity policies and RMF processes, excellent communication skills, and the ability to work independently while providing cybersecurity guidance and support to technical personnel, leadership, and organizational stakeholders

Essential Job Functions

• Serve as the Information System Security Manager (ISSM) and perform applicable DoD 8140 Cybersecurity Work Role responsibilities.
• Validate and verify that administrative and technical personnel meet applicable baseline certification and training requirements before receiving elevated system access.
• Administer and maintain Privileged Access Agreements (PAAs) and conduct recurring audits of privileged accounts.
• Serve as a cybersecurity consultant and advisor to unit technicians and organizational personnel.
• Administer, coordinate, and track compliance with enterprise cybersecurity architecture, strategy, policies, plans, and supplemental requirements.
• Ensure Risk Management Framework (RMF) requirements are satisfied and that applicable Authority to Operate (ATO) authorizations remain current.
• Maintain accurate and current cybersecurity documentation, records, and supporting artifacts.
• Support configuration management reviews and ensure appropriate security mechanisms are implemented.
• Maintain cybersecurity information and organizational data within systems including ITIPS, AFRL RMF Workflow, and Enterprise Mission Assurance Support Service (eMASS).
• Administer and track systems and enclaves within eMASS and maintain current ATO packages.
• Prepare, maintain, and distribute cybersecurity plans, instructions, and Standard Operating Procedures (SOPs), including:
  • System Security Plans (SSPs)
  • Security Assessment Reports (SARs)
  • Plans of Action and Milestones (POA&Ms)
  • Risk assessment reports
  • Body of Evidence documentation
  • Network topology diagrams
  • Hardware and software inventories
• Identify, document, track, and mitigate cybersecurity vulnerabilities identified through assessments, audits, and inspections.
• Maintain eMASS artifacts and ensure required documentation is updated within established timelines.
• Maintain system hardening checklists and Security Technical Implementation Guides (STIGs) and coordinate remediation activities.
• Support internal and external cybersecurity inspections and audits conducted by Government organizations.
• Implement, assess, manage, and monitor eMASS security controls and assessment procedures.
• Utilize Assured Compliance Assessment Solution (ACAS) or other Air Force-approved vulnerability scanning tools and interpret scan results.
• Conduct application, technical, and non-technical cybersecurity risk and vulnerability assessments.
• Support Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance activities.
• Apply cybersecurity strategies and requirements to cloud computing environments and deployment models.
• Ensure cybersecurity training requirements are satisfied for users requiring continued network access.
• Manage logical system access onboarding and offboarding processes, including DD Form 2875 routing and organizational account coordination.
• Coordinate quarterly media destruction in accordance with applicable Air Force and local policies.
• Participate in cybersecurity meetings and provide meeting minutes and documentation supporting RMF requirements.
• Assist with system discovery, categorization, and entry into eMASS.
• Assist in developing compliant cybersecurity solutions and organizational security policies.
• Support hardware and software entry/exit requirements in accordance with applicable policies.
• Assist with management of Memorandums of Agreement (MOAs), Memorandums of Understanding (MOUs), and Acknowledgement of Responsibility (AOR) letters supporting the RMF accreditation program.
• Support the tracking and reporting of DoD Directive 8140.03 certification requirements.
• Participate in applicable DoD 8140.03 meetings and teleconferences and assist with developing compliance metrics and briefings.
• Support the AFRL Cybersecurity Working Group (CSWG), including meetings, action-item tracking, documentation, and project coordination.
• Assist in developing cybersecurity processes, concepts of operation, implementation standards, and policies.
• Provide cybersecurity briefings and recommendations to senior Government, Air Force, AFRL, Joint, DoD, and industry leadership as required.
• Provide customer service and technical guidance to users regarding cybersecurity policies, procedures, configurations, and implementation.
• Support AFRL Inspector General inspection activities, including pre- and post-inspection requirements.
• Support research, selection, implementation, operation, metrics collection, and reporting for enterprise IT pilot and exploratory projects.
• Support emerging technology initiatives involving cybersecurity, virtualization, collaborative systems, research computing, mobile technologies, automated IT management, and public, private, and hybrid cloud services.