Cybersecurity Analyst - ISSM - Tinker AFB

Position Description & Qualifications

Serco is seeking an Cybersecurity Analyst / Information System Security Manager (ISSM) supporting the 76th Software Maintenance Group at Tinker AFB, OK. The ISSM will serve as the senior security authority and Cybersecurity SME for assigned information systems, ensuring compliance with DoD Cybersecurity requirements, managing system ATO, and guiding technical teams in the protection of classified environments.

In this role, you will:

Lead the implementation, management, and enforcement of DoD, Air Force, and NIST Cybersecurity policies.

Responsible for updating all documentation from NIST 800-53 r4 to NIST 800-53 r5

Serve as the primary authority for RMF lifecycle activities including categorization, control selection, validation, continuous monitoring, and ATO package submission.

Manage and maintain system security documentation including SSPs, SCTMs, POA&Ms, Incident Response Plans, and Contingency Plans within eMASS.

Conduct cybersecurity inspections, audits, and compliance reviews.

Provide expert guidance to system owners, administrators, and engineers.

Oversee vulnerability and patch management activities including ACAS scans, system alerts, and patch mitigations.

Work with Configuration Management to help direct change processes and security impact analyses.

Monitor security posture across hybrid Windows and Linux environments.

Ensure continuity with incident response, backup and recovery response.

Team player | Provide technical cybersecurity mentorship to team members

Act as the primary Cybersecurity liaison to government stakeholders and leadership.

Provide oversight and direction to administrators, engineers, and technicians.

Present system status, vulnerabilities, and POA&M progress.

To be successful in this role, you will have:

An active DoD Top Secret security clearance with SCI eligibility.

SAP/SAR eligibilty.

A Bachelor's degree and 8 years of Cybersecurity experience (or equivalent).

OR an Associate's degree and 10 years of Cybersecurity experience.

DoD 8570 IAM Level III certification (CISSP, CISM, GSLC, etc.) or DoD 8140 Cybersecurity ISSM - Intermediate qualifications

Active CAPM certification or obtain within 12 months of hire

RMF ATO Process experience.

Experience in mixed Windows/Linux enterprise environments.

The ability to travel up to 10%.

Additional desired experience and skills:

ISSM/ISSO experience with PaaS or shared-service offering.

Hands-on experience securing cloud environments such as Microsoft Azure commercial and/or Azure Gov.

Experience authorizing hybrid architectures spanning commercial and/or gov cloud and on-premises infrastructure, including boundary definition and interconnection documentation for hybrid systems.

Working knowledge of container platforms such as Kubernetes, and container image hardening, scanning, and registry governance.

Experience applying RMF to CI/CD pipelines, including control assessment of pipeline components, build integrity, artifact provenance, and automated gate enforcement.

Familiarity with Infrastructure as Code (IaC) and Configuration as Code (CaC), such as Terraform, ARM/Bicep, and Ansible, including how IaC affects configuration management, baseline drift, and change control under an existing authorization.

Understanding of how to sustain an authorization boundary under Continuous Integration and Continuous Delivery (CI/CD), including control inheritance, security impact analysis at deployment velocity, and evidence generation as a pipeline artifact rather than a manual collection effort.

Experience supporting systems operating at multiple classification levels, including management of separate authorization boundaries and data handling requirements across levels.

Familiarity with Cross Domain Solutions (CDS), NCDSMO, and data transfer flow validation.

Hands-on experience operating and managing ACAS/Tenable, including scan configuration, credentialed scanning, and false-positive adjudication.

Practical experience with SCAP/STIG workflow to include benchmark selection, STIG Viewer/Evaluate-STIG checklist production, and translating findings into POA&M entries.

Proficiency in eMASS, including package build, control response authoring, artifact management and workflow submission.

Experience with supply chain risk management (SCRM) as applied to software dependencies, third-party libraries, and container base images (SBOM familiarity ideal).

Working knowledge of ITAR/export control requirements and their impact on personnel access, data residency, and administrative access to cloud environments

Proficiency with Atlassian Suite toolset (Jira, Confluence, Bitbucket).

Familiarity with Agile development methodologies (Scrum, Kanban, etc..), including experience decomposing security and compliance requirements into user stories, participating in sprint events, and embedding security acceptance criteria into defined task completions.

Company Overview

Serco Inc. (Serco) is the Americas division of Serco Group, plc. In North America, Serco’s 9,000+ employees strive to make an impact every day across 100+ sites in the areas of Defense, Citizen Services, and Transportation. We help our clients deliver vital services more efficiently while increasing the satisfaction of their end customers. Serco serves every branch of the U.S. military, numerous U.S. Federal civilian agencies, the Intelligence Community, the Canadian government, state, provincial and local governments, and commercial clients. While your place may look a little different depending on your role, we know you will find yours here. Wherever you work and whatever you do, we invite you to discover your place in our world. Serco is a place you can count on and where you can make an impact because every contribution matters.

To review Serco benefits please visit: https://careers.serco-na.com/us/en/what-we-offer . If you require an accommodation with the application process please email: careers@serco-na.com or call the HR Service Desk at 800-628-6458, option 1. Please note, due to EEOC/OFCCP compliance, Serco is unable to accept resumes by email.

Candidates may be asked to present proof of identity during the selection process. If requested, this will require presentation of a government-issued I.D. (with photo) with name and address that match the information entered on the application. Serco will not take possession of or retain/store the information provided as proof of identity. For more information on how Serco uses your information, please see our Applicant Privacy Policy and Notice.

Serco does not accept unsolicited resumes through or from search firms or staffing agencies without being a contracted approved vendor. All unsolicited resumes will be considered the property of Serco and will not be obligated to pay a placement or contract fee. If you are interested in becoming an approved vendor at Serco, please email Agencies@serco-na.com .

Serco is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, and other legally protected characteristics.

Pay Transparency

Our Total Rewards package includes competitive pay, performance-based incentives, and benefits that promote well-being and work-life balance—so you can thrive both professionally and personally. Eligible employees also gain access to a wide range of benefits from comprehensive health coverage and health savings accounts to retirement plans, life and disability insurance, and time-off programs that support work-life balance. Program availability may vary based on factors such as contract type, location, hire date, and applicable collective bargaining agreements.

Salary range: The range for this position can be found at the top of this posting. This range is provided as a general guideline and represents a good faith estimate across all experience levels. Actual base salary will be determined by a variety of factors, including but not limited to, the scope of the role, relevant experience, job-related knowledge, education and training, key skills, and geographic market considerations. For roles available in multiple states, the range may vary to reflect differences in local labor markets. In addition to base salary, eligible positions may include other forms of compensation such as annual bonuses or long-term incentive opportunities. Benefits – Comprehensible benefits for full-time employees (part-time employees receive a limited package tailored to their role):

Medical, dental, and vision insurance

Robust vacation and sick leave benefits, and flexible work arrangements where permitted by role or contract

401(k) plan that includes employer matching funds

Tuition reimbursement program

Life insurance and disability coverage

Optional coverages that can be purchased, including pet insurance, home and auto insurance, additional life and accident insurance, critical illness insurance, group legal, ID theft protection

Birth, adoption, parental leave benefits

Employee Assistance Plan

To review all Serco benefits please visit: https://careers.serco-na.com/us/en/about-us .

Serco complies with all applicable state and local leave laws, including providing time off under the Colorado Healthy Families and Workplaces Act for eligible Colorado residents, in alignment with our policies and benefit plans. The application window for this position is for no more than 60 days. We encourage candidates to apply promptly after the posting date, as the position may close earlier if filled or if the application volume exceeds expectations. Please submit applications exclusively through Serco’s external (or internal) career site. If an applicant has any concerns with job posting compliance, please send an email to: careers@serco-na.com .