DAF Financial Management (FM) Enterprise Cybersecurity and Systems/FMWorkFlow Engineering Support

Position Overview

The ISSM provides senior cybersecurity leadership and comprehensive RMF lifecycle support for systems within the DAF FM Authorizing Official boundary. The position serves as a senior advisor to the FM AO, AODR, and Program Offices; leads authorization and compliance engineering; oversees enterprise vulnerability and risk-management activities; maintains authorization artifacts in eMASS and ITIPS; and develops risk-informed decision packages, reports, policies, and leadership briefings

Essential Duties & Responsibilities

• Provide expert cybersecurity and RMF advisory support to the FM Authorizing Official (AO), Authorizing Official Designated Representative (AODR), and Program Offices across the DAF FM AO boundary.
• Analyze Federal, DoD, and Air Force cybersecurity policy and translate requirements into actionable implementation guidance for FM systems.
• Lead and oversee full RMF lifecycle support, including security control selection, implementation, validation, assessment support, authorization, and continuous monitoring.
• Develop, manage, review, and sustain required authorization artifacts, including System Security Plans (SSPs), Risk Assessment Reports (RARs), Plans of Action & Milestones (POA&Ms), and supporting evidence in eMASS and ITIPS for multiple systems.
• Conduct or oversee vulnerability assessments, risk analysis, and development of mitigation strategies across the FM portfolio.
• Coordinate vulnerability remediation with system owners and Program Management Offices and track enterprise-wide vulnerability trends and remediation status for FM leadership.
• Generate, review, and quality-control comprehensive A&A Decision Staff Packages containing risk analysis, control summaries, mission impact, and formal recommendations for ATO, ATO with Conditions, or Denial.
• Ensure A&A Decision Staff Packages are completed no later than 10 business days after receipt of a complete package from the PMO.
• Facilitate communication among system owners, security personnel, Program Offices, and the FM AO to resolve cybersecurity and information-assurance issues.
• Prepare and/or oversee AO Decision Support Briefings and Mission Impact Assessments for authorization decisions.
• Prepare and support leadership briefings, working groups, governance forums, and cybersecurity status updates.
• Review security-control assessment findings, identify gaps and weaknesses, assess associated risk, and recommend remediation strategies.
• Oversee monthly POA&M status reporting, including open items, closure rates, overdue actions, and risk trends across the FM AO boundary.
• Develop or oversee POA&M escalation reports for high-risk or significantly overdue items, including risk, mission impact, and recommended leadership action.
• Maintain or oversee the quarterly FM Systems Inventory & Boundary Document, including systems within the FM AO boundary, key contacts, authorization status, and ATO expiration dates.
• Develop, review, or update FM-level cybersecurity policies, SOPs, templates, checklists, and implementation guidance for Government review.
• Prepare or oversee the Annual Program Review briefing summarizing cybersecurity performance, major accomplishments, systemic risks, and strategic recommendations.
• Coordinate cybersecurity activities with infrastructure, database, systems administration, configuration management, and software engineering personnel when technical changes affect security posture or authorization status.
• Support Government QASP surveillance by ensuring cybersecurity compliance artifacts, status reports, findings, and performance information are complete, current, traceable, and suitable for Government review.

Security, Access & Compliance Responsibilities

• Comply with applicable Air Force Instructions, Air Force System Security Instructions, Air Force System Security Memorandums, and other Government cybersecurity requirements.
• Complete Air Force-mandated Information Assurance Awareness Training before access to Government computing resources.
• Complete and maintain required DD Form 2875 System Authorization Access Request documentation for applicable EAFB/WPAFB network access.
• Obtain and properly display required CAC, Restricted Area Badge, contractor identification, or other installation credentials as applicable.
• Protect Personally Identifiable Information (PII) in accordance with NIST SP 800-122 and comply with Privacy Act requirements.
• Complete the required Contractor Employee Non-Disclosure Agreement.
• Immediately report known or suspected security violations or incidents to the FMWF PMO and assist Government security-related inquiries or investigations as directed.
• Use Government systems, networks, connectivity, email, servers, Internet access, and GFE only for authorized Government official business and acknowledge applicable monitoring requirements.
• Support COOP activities requested by the PMO when cybersecurity/RMF participation is required.

Recommended Senior-Level

• Demonstrated experience advising AOs, AODRs, system owners, PMOs, ISSMs/ISSOs, and senior Government stakeholders.
• Experience supporting multiple systems within an enterprise authorization boundary.
• Strong leadership, technical writing, briefing, audit-readiness, risk-communication, and cross-functional coordination skills.
• Experience mentoring or overseeing cybersecurity/RMF personnel is preferred; this is an employer preference and is not expressly assigned by the PWS.
• Experience with NIST SP 800-53, DoDI 8510.01, DoDI 8500.01, CNSSI 1253, FIPS 199, DISA STIG/SRG processes, vulnerability scanning, and continuous monitoring is strongly preferred where applicable to the Government environment.

Equal Employment Opportunity

We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable law.