Full Job Description
Job Position:
The Information Systems Security Manager (ISSM) is responsible for protecting the organization's information, networks, systems, and computing resources from security threats and for maintaining the cybersecurity and Risk Management Framework (RMF) posture of classified programs in accordance with applicable government directives, customer requirements, and program requirements. The ISSM coordinates with program and project stakeholders, Information Assurance (IA) personnel, the Facility Security Officer (FSO), Contractor Program Security Officers (CPSOs), and IT and Security teams to establish, implement, monitor, and maintain information systems security policies, procedures, and controls, including configuration change-management standards.
Key Responsibilities
• Develop, implement, maintain, and review information systems security policies, procedures, and plans in accordance with applicable requirements, including 32 CFR Part 117 / National Industrial Security Program Operating Manual (NISPOM), the Defense Security Service Authorization and Assessment Process Manual (DAAPM), the Joint Special Access Program (SAP) Implementation Guide (JSIG), ICD 503, the NIST Risk Management Framework (RMF), and Security Technical Implementation Guides (STIGs), as applicable to assigned systems and programs.
• Coordinate with program and project stakeholders, IA staff, the FSO, CPSOs, and IT and Security personnel to define, implement, and maintain an acceptable information systems security posture.
• Lead or support RMF activities for classified information systems, including preparation and maintenance of authorization documentation and obtaining and maintaining Authority to Operate (ATO) approvals.
• Implement and oversee the Information Assurance (IA) program for assigned systems and ensure security requirements are incorporated into system operation, administration, and configuration change management.
• Identify vulnerabilities, threats, and potential security risks; assess their impact; define and coordinate mitigation actions; and track corrective measures through completion.
• Oversee or coordinate investigations into information security incidents and suspected security breaches, document findings, and implement or track corrective actions.
• Perform continuous monitoring of information systems, including security event log review and analysis, periodic self-inspections, technical tests, and compliance reviews.
• Verify that workstations, servers, network devices, peripherals, and other system components remain configured and operated in accordance with their approved security posture and authorization conditions.
• Assess and audit the security configuration and compliance of Windows and Linux operating systems, virtualization environments, network devices, and related infrastructure across peer-to-peer, LAN, and WAN environments.
• Develop and maintain disaster recovery and system-restoration plans to support recovery of data and system functionality.
• Provide cybersecurity and information assurance guidance, communicate security responsibilities, and educate personnel on applicable security policies and cybersecurity best practices.
• Coordinate with relevant stakeholders to maintain required security documentation, address assessment findings, and support audits, inspections, and customer or government reviews.
• Perform other job-related duties as assigned.
Knowledge, Skills, and Abilities:
• Working knowledge of 32 CFR Part 117 / NISPOM, DAAPM, ICD 503, JSIG, NIST RMF, and STIG requirements relevant to assigned systems.
• Experience with information systems security administration, system authorization or certification, compliance auditing, and security assessment activities.
• Experience evaluating and auditing Windows and Linux systems, virtualization platforms, network devices, and peripherals.
• Ability to identify security risks, analyze technical and procedural issues, develop practical mitigations, and follow corrective actions through completion.
• Strong written and verbal communication skills, including the ability to coordinate across technical teams, security personnel, program stakeholders, and management.
Minimum Qualifications:
• At least two (2) years of experience serving as an ISSM or Information Systems Security Officer (ISSO), implementing NISPOM, DAAPM, and ICD 503 requirements.
• Experience with configuration, certification/authorization, auditing, or compliance analysis of Windows and Linux operating systems, virtualization, network devices, and related systems.
• DoD 8570 Information Assurance Management (IAM) Level III certification, such as CISA, CISM, or CISSP, or an applicable successor certification accepted for the position.
• Active DoD Secret security clearance and U.S. citizenship.
Skills & Requirements Qualifications
