Information System Security Manager

About the Role: The Information System Security Manager (ISSM) / Cybersecurity Manager will provide Cross Domain Solutions (CDS) Network Architect Certification and Accreditation (C&A) support and cybersecurity leadership and oversight for assigned information systems, classified networks, cross-domain solutions, laboratories, and flight-test environments at the Secret level and below. The ISSM will oversee Risk Management Framework (RMF) execution in accordance with DoDI 8510.01, Risk Management Framework for DoD Information Technology, 12 March 2014 or later; AFI 17-101, Risk Management Framework for Air Force Information Technology, 2 February 2017 or later; and applicable Air Force Research Laboratory (AFRL) RMF guidance and policies. Responsibilities include managing the implementation, documentation, and testing of applicable Information Assurance (IA) security controls; continuous monitoring; vulnerability remediation; and preparation and maintenance of security documentation and artifacts, including control assessment responses, network topology diagrams, hardware and software inventories, ports and protocols lists, and Plans of Action and Milestones (POA&Ms). The ISSM will also oversee Interim Authorization to Test (IATT) and Authorization to Operate (ATO) preparation and serve as the primary cybersecurity liaison among system owners, Information System Security Officers (ISSOs), engineers, program managers, security personnel, the Authorizing Official (AO), and government stakeholders.

Additional Responsibilities Include, but are not Limited To:

• Serve as the Information System Security Manager (ISSM) for assigned information systems, classified networks, laboratories, flight-test environments, and Cross Domain Solutions (CDS).
• Establish and manage the system security program in accordance with DoDI 8510.01, AFI 17-101, Air Force Research Laboratory (AFRL) guidance, 25 AF guidance, and applicable customer policies and procedures.
• Direct and oversee Information System Security Officer (ISSO) activities and Risk Management Framework (RMF) execution, establishing priorities for security control implementation, assessment, remediation, and continuous monitoring.
• Review and approve, at the appropriate organizational level, security documentation and RMF work products prepared by ISSOs and technical personnel, including:
• System Security Plans (SSPs) and Security Assessment Reports (SARs).
• Plans of Action and Milestones (POA&Ms) and risk assessments.
• Security control implementation documentation, supporting evidence, and assessment artifacts.
• Continuous monitoring reports.
• Interim Authorization to Test (IATT) and Authorization to Operate (ATO) packages.
• Conduct, coordinate, and evaluate vulnerability scans, Assured Compliance Assessment Solution (ACAS) results, Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) reviews, penetration tests, and other security assessments. Analyze findings, articulate potential mission and operational impacts, and recommend appropriate corrective actions.
• Lead risk identification, analysis, mitigation, and escalation activities, including researching and recommending compensating controls, system modifications, or operational restrictions to eliminate or reduce identified risks to an acceptable level.
• Track security deficiencies, remediation actions, and POA&M milestones through resolution or formal risk acceptance, escalating unresolved risks and deficiencies as appropriate.
• Establish and oversee continuous monitoring processes, reporting requirements, and assessment schedules to maintain system security compliance and authorization readiness.
• Lead and coordinate cybersecurity activities supporting IATT, ATO, reauthorization, security assessments, inspections, and customer reviews for laboratory, flight, and field-testing environments.
• Coordinate with the Authorizing Official (AO), Authorizing Official’s Representative (AOR), Security Control Assessor (SCA), system owners, program managers, mission owners, engineers, and security personnel to ensure RMF documentation, system security requirements, and authorization activities are properly maintained and executed.
• Brief government and contractor leadership on system security posture, identified risks, remediation progress, POA&M status, and authorization milestones.
• Lead cybersecurity reviews and work closely with the RYZT Combat ID, Blue Guardian, Test, RYSIL, engineering, and network teams to develop and implement cross-domain security solutions that:
• Enable the secure integration of Top Secret, Secret, and unclassified data into consolidated products supporting flight tests and demonstrations.
• Facilitate multi-sensor data fusion, integration, and testing through a common data bus within systems integration laboratories and aircraft-mounted sensor pods.
• Support the development of data repositories capable of storing, accessing, and developing multi-level sensor models and associated data.
• Determine computer network architecture and infrastructure requirements supporting the RY digital strategy, including connectivity to other RY networks and associated hardware, such as guards and diodes.
• Evaluate cross-domain data flows, interfaces, and security controls to ensure compliance with applicable cybersecurity requirements.
• Support preparation of RMF documentation required to obtain IATTs and ATOs for flight, laboratory, and field testing.
• Provide technical direction, guidance, and mentorship to ISSOs and cybersecurity specialists to ensure consistent execution of security requirements and RMF responsibilities.
• Assist with proposal development, as required.
• Perform other duties as assigned.

• Technical knowledge of cross domain solutions and work hand in hand with their engineers to develop one.

• Familiar with DoD and AF guidance on Security in general and Cybersecurity in particular.
• Awareness of DISA STIGs, ACAS vulnerability scanner, and AF Ports, Protocols, and Services process.
• Familiar with the Risk Management Framework process (NIPR/SIPR eMASS, AFRL process).
• Possibly XACTA as well if will be involved in RMF for TS/SCI.
• Technical understanding to be able to discuss computer/network issues.
• Familiar with AF TEMPEST policies and process.

Certificate, License, and Registration Requirements:

Required: Security+ CE or another contract-approved DoD baseline certification, unless the contract specifies a different minimum.

Preferred: CISSP, CISM, CAP, CASP+, or another advanced cybersecurity certification., * Demonstrated experience as an ISSM, senior ISSO, cybersecurity manager, RMF lead, or comparable information assurance leader.

• Experience leading RMF activities from system categorization through IATT, ATO, continuous monitoring, and reauthorization.
• Experience managing ISSOs or coordinating cybersecurity work across multidisciplinary technical teams.
• Experience with eMASS, Xacta, EBS, or comparable RMF and authorization-management tools.
• Strong knowledge of DoD and Air Force cybersecurity policy, RMF, security controls, vulnerability management, STIGs, and POA&M processes.
• Experience evaluating risk and presenting mitigation recommendations to government stakeholders and senior leadership.
• Experience with classified systems, SCI environments, cross-domain solutions, or other high-consequence security architectures.
• Must be able to effectively communicate with customer and fulfill all duties and responsibilities as listed in the contract.
• Must be proficient in Microsoft Office suite including, but not limited to: Word, PowerPoint, Excel, and Outlook.

Security Clearance Requirements: Top Secret/SCI Clearance, * Hardworking Individuals: If you’re someone who takes initiative, loves a challenge, and is committed to excellence, you’ll feel right at home here.

The annual base salary range for this position TBD. Please note that the salary information is a general guideline only. At Sawdey Solution Services, we recognize that attracting the best talent is key to our strategy and success as a company. We will consider several factors when extending an offer to an applicant. These factors include (but are not limited to) the position, associated responsibilities, work experience, education, related training, and related skills., * Talented Professionals: Whether you’re an expert in your field or a rising star, we recognize your potential and support your effort toward success.

• Diverse Perspectives: Our strength lies in our diversity. We believe that a diverse team fosters creativity, innovation, and achievement.

About the Organization Sawdey Solution Services, an ISO 9001 certified and CMMI-SVC v2 Level 3 appraised corporation, has built a nationwide and global footprint as a leading government contracting organization. Specializing in cybersecurity, systems engineering, and operational support, Sawdey invites you to be a part of a team that’s at the forefront of securing our nation. Operating successfully since 2001, we are a Woman Owned/Service-Disabled Veteran Owned Business. We provide our clients with premier professional services and technology solutions in an employee-centric environment. We are extremely proud of the culture we have created.

Why Choose Us?

• Mission-Critical Work: We play a vital role in ensuring the security of our nation’s digital infrastructure.
• Professional Growth: Embrace the opportunity to take on diverse and dynamic roles that challenge and inspire you.
• Collaborative Culture: You are joining a unified team where your unique contributions are valued and celebrated.