> Markdown version of [/jobs/ext/2557268-issm-south-dakota](https://www.wearedevelopers.com/jobs/ext/2557268-issm-south-dakota). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # ISSM -South Dakota - **Company:** P3S Corporation - **Location:** Rapid City, SD, United States - **Salary:** $100,000.0 - $160,000.0 - **Contract:** Permanent contract - **Skills:** Access Network, Configuration Management, Databases, Decision Support Systems, Federal Information Processing Standards (FIPS), Software Engineering, Software Vulnerability Management, Network Server, Plan of Action and Milestones, Vulnerability Analysis - **Published:** August 8, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=78acdca09307e859 ## About the Role * Demonstrated experience advising AOs, AODRs, system owners, PMOs, ISSMs/ISSOs, and senior Government stakeholders. * Experience supporting multiple systems within an enterprise authorization boundary. * Strong leadership, technical writing, briefing, audit-readiness, risk-communication, and cross-functional coordination skills. * Experience mentoring or overseeing cybersecurity/RMF personnel is preferred; this is an employer preference and is not expressly assigned by the PWS. * Experience with NIST SP 800-53, DoDI 8510.01, DoDI 8500.01, CNSSI 1253, FIPS 199, DISA STIG/SRG processes, vulnerability scanning, and continuous monitoring is strongly preferred where applicable to the Government environment. ## Description The ISSM provides senior cybersecurity leadership and comprehensive RMF lifecycle support for systems within the DAF FM Authorizing Official boundary. The position serves as a senior advisor to the FM AO, AODR, and Program Offices; leads authorization and compliance engineering; oversees enterprise vulnerability and risk-management activities; maintains authorization artifacts in eMASS and ITIPS; and develops risk-informed decision packages, reports, policies, and leadership briefings, * Provide expert cybersecurity and RMF advisory support to the FM Authorizing Official (AO), Authorizing Official Designated Representative (AODR), and Program Offices across the DAF FM AO boundary. * Analyze Federal, DoD, and Air Force cybersecurity policy and translate requirements into actionable implementation guidance for FM systems. * Lead and oversee full RMF lifecycle support, including security control selection, implementation, validation, assessment support, authorization, and continuous monitoring. * Develop, manage, review, and sustain required authorization artifacts, including System Security Plans (SSPs), Risk Assessment Reports (RARs), Plans of Action & Milestones (POA&Ms), and supporting evidence in eMASS and ITIPS for multiple systems. * Conduct or oversee vulnerability assessments, risk analysis, and development of mitigation strategies across the FM portfolio. * Coordinate vulnerability remediation with system owners and Program Management Offices and track enterprise-wide vulnerability trends and remediation status for FM leadership. * Generate, review, and quality-control comprehensive A&A Decision Staff Packages containing risk analysis, control summaries, mission impact, and formal recommendations for ATO, ATO with Conditions, or Denial. * Ensure A&A Decision Staff Packages are completed no later than 10 business days after receipt of a complete package from the PMO. * Facilitate communication among system owners, security personnel, Program Offices, and the FM AO to resolve cybersecurity and information-assurance issues. * Prepare and/or oversee AO Decision Support Briefings and Mission Impact Assessments for authorization decisions. * Prepare and support leadership briefings, working groups, governance forums, and cybersecurity status updates. * Review security-control assessment findings, identify gaps and weaknesses, assess associated risk, and recommend remediation strategies. * Oversee monthly POA&M status reporting, including open items, closure rates, overdue actions, and risk trends across the FM AO boundary. * Develop or oversee POA&M escalation reports for high-risk or significantly overdue items, including risk, mission impact, and recommended leadership action. * Maintain or oversee the quarterly FM Systems Inventory & Boundary Document, including systems within the FM AO boundary, key contacts, authorization status, and ATO expiration dates. * Develop, review, or update FM-level cybersecurity policies, SOPs, templates, checklists, and implementation guidance for Government review. * Prepare or oversee the Annual Program Review briefing summarizing cybersecurity performance, major accomplishments, systemic risks, and strategic recommendations. * Coordinate cybersecurity activities with infrastructure, database, systems administration, configuration management, and software engineering personnel when technical changes affect security posture or authorization status. * Support Government QASP surveillance by ensuring cybersecurity compliance artifacts, status reports, findings, and performance information are complete, current, traceable, and suitable for Government review. Security, Access & Compliance Responsibilities * Comply with applicable Air Force Instructions, Air Force System Security Instructions, Air Force System Security Memorandums, and other Government cybersecurity requirements. * Complete Air Force-mandated Information Assurance Awareness Training before access to Government computing resources. * Complete and maintain required DD Form 2875 System Authorization Access Request documentation for applicable EAFB/WPAFB network access. * Obtain and properly display required CAC, Restricted Area Badge, contractor identification, or other installation credentials as applicable. * Protect Personally Identifiable Information (PII) in accordance with NIST SP 800-122 and comply with Privacy Act requirements. * Complete the required Contractor Employee Non-Disclosure Agreement. * Immediately report known or suspected security violations or incidents to the FMWF PMO and assist Government security-related inquiries or investigations as directed. * Use Government systems, networks, connectivity, email, servers, Internet access, and GFE only for authorized Government official business and acknowledge applicable monitoring requirements. * Support COOP activities requested by the PMO when cybersecurity/RMF participation is required. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Kubernetes Security - Challenge and Opportunity](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) - [Small, Secure, Interconnected: The next Internet Protocol](https://www.wearedevelopers.com/videos/100062-small-secure-interconnected-the-next-internet-protocol) - [Kubernetes and Microservices with Multi-Model Databases](https://www.wearedevelopers.com/videos/382-kubernetes-and-microservices-with-multi-model-databases) - [Maturity assessment for technicians or how I learned to love OWASP SAMM](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm) - [tRPC: API schemas are pure overhead](https://www.wearedevelopers.com/videos/796-trpc-api-schemas-are-pure-overhead) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [What Makes WeAreDevelopers World Congress Different From Every Other Tech Event?](https://www.wearedevelopers.com/magazine/701-what-makes-wearedevelopers-world-congress-different-from-every-other-tech-event) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)