WRA is seeking a hands-on Information Systems Security Manager to support classified information systems, lead Risk Management Framework authorization and continuous monitoring activities, and help operate WRA's CMMC program and CUI enclave. The position is ideal for an ISSM or experienced ISSO ready to grow into broader program ownership.
This is a broad, practical role supporting multiple specialized security environments within a large organization. The ISSM will work across security documentation, compliance, technical analysis, and hands-on implementation. Routine user support is handled by cleared technical staff, but the ISSM must be able to perform ISSO and limited systems administration work when needed. Success requires initiative, curiosity, sound judgment, attention to detail, and a willingness to work outside a narrowly defined lane.
Responsibilities:- Classified systems and RMF: Manage and support authorization, reauthorization, and continuous monitoring for government-sponsored classified systems and local facilities.
- Develop and maintain ATO packages and supporting artifacts, including System Security Plans, control implementation statements, assessment evidence, POA&Ms, agreements, test plans, and technical documentation.
- Perform control assessments, self-inspections, vulnerability management, recurring reporting, and security-impact reviews; coordinate changes and authorization matters with government security stakeholders.
- Maintain authorization information and evidence in eMASS or sponsor-specific systems. Prior eMASS experience is helpful but not required.
- CMMC and CUI enclave: Help lead WRA's CMMC program and CUI enclave, including NIST SP 800-171 documentation, evidence, policies, POA&Ms, access and change reviews, continuous monitoring, assessment preparation, and remediation tracking.
- Use IntelliGRC to maintain CMMC documentation and evidence, and coordinate shared responsibilities and deliverables with WRA's managed service provider (MSP) and external consultants. Prior IntelliGRC experience is not required.
- Hands-on security: Review logs, configure controls such as multifactor authentication, use vulnerability and compliance scanning tools, apply and remediate SRGs and STIGs, investigate findings, and validate corrective actions.
- Perform ISSO or limited systems administration duties for specific programs and serve as backup to cleared technical staff when needed. This is not primarily a help desk position.
- Support incident response, required reporting, policy and training activities, and clear communication of authorization status, vulnerabilities, risks, and remediation.
- Research unfamiliar requirements and technologies, develop practical recommendations, and perform other related security and IT duties in a small, collaborative environment.
Requirements:- Must be a US Citizen with Active DoD Top Secret/SCI clearance.
- Security+ or another applicable cybersecurity certification.
- 5+ years of experience in as ISSO or ISSM role
- Associate degree required, bachelor's degree preferred
- Practical experience supporting RMF authorization and continuous monitoring, including substantive contributions to an ATO package, control documentation, assessment evidence, or vulnerability remediation.
- Working knowledge of NIST SP 800-53, RMF, security controls, POA&Ms, and the requirements to obtain and maintain an ATO.
- Hands-on ability with Windows systems, identity and access management, networks, logging, vulnerability scanning, security baselines, and troubleshooting.
- Strong technical writing and communication skills, with the ability to work independently, manage competing priorities, collaborate with technical and nontechnical stakeholders, and seek assistance when appropriate.
Preferred Qualifications:- Experience serving as an ISSM. WRA will also consider experienced ISSOs who have contributed substantially to authorization and continuous monitoring activities and are ready to assume broader responsibility.
- Experience taking a system through authorization, reauthorization, or a significant continuous monitoring cycle. Final ownership of a complete ATO package is preferred but not required.
- Familiarity with eMASS, ICD 503, SAP or SAR environments, or sponsor-specific authorization processes.
- Knowledge of CMMC, NIST SP 800-171, DFARS cybersecurity requirements, IntelliGRC or another GRC platform, and common security tools for vulnerability scanning, logging, endpoint protection, or configuration compliance.
- CISSP, CISM, or another advanced security certification.
Benefits:WRA recognizes that employees play an important role in its success. Our commitment to full-time employees is reflected in the comprehensive benefits package we offer:
- Flexible work schedule options
- Competitive salary
- Leave accrual and paid holidays
- Healthcare benefits
- Group Life Insurance, as well as additional optional life Insurance, short and long term disability insurance
- Flexible spending accounts for medical and dependent care reimbursement
- 401(k) Retirement Plan
- Tuition Reimbursement
- Employee Assistance Program
- Parental and maternity leave benefits
The expected compensation range for this position is $110,000.00 - $140,000.00. This range represents a good faith estimate for this position. The specific compensation offered to a candidate may vary based on factors including, but not limited to, the candidate's relevant knowledge, training, skills, work location, and/or experience.
Applicants must be currently authorized to work in the United States on a full-time basis without the need for employment-based visa sponsorship now or in the future. WRA will not sponsor applicants for U.S. work visa status for this opportunity. (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)
Position # 3526
#LI -Onsite #LI - Mid-Level
