Information System Security Manager (ISSM)

Nammo Defense Systems, Inc•Perry, FL

About The Position

The Information Systems Security Manager (ISSM) protects the organization’s information, networks, systems, and computing resources from security threats and maintains the cybersecurity and Risk Management Framework (RMF) posture of classified programs in accordance with applicable government directives, customer requirements, and program requirements. The ISSM coordinates with program and project stakeholders, Information Assurance (IA) personnel, the Facility Security Officer (FSO), Contractor Program Security Officers (CPSOs), and IT and Security teams to establish, implement, monitor, and maintain information systems security policies, procedures, and controls, including configuration change-management standards.

Requirements

At least two years of experience serving as an ISSM or Information Systems Security Officer (ISSO), implementing NISPOM, DAAPM, and ICD 503 requirements.
Experience with configuration, certification/authorization, auditing, or compliance analysis of Windows and Linux operating systems, virtualization, network devices, and related systems.
DoD 8570 Information Assurance Management (IAM) Level III certification, such as CISA, CISM, or CISSP, or an applicable successor certification accepted for the position.
Active DoD Secret security clearance and U.S. citizenship.
Working knowledge of 32 CFR Part 117 / NISPOM, DAAPM, ICD 503, JSIG, NIST RMF, and STIG requirements relevant to assigned systems.
Experience with information systems security administration, system authorization or certification, compliance auditing, and security assessment activities.
Experience evaluating and auditing Windows and Linux systems, virtualization platforms, network devices, and peripherals.
Ability to identify security risks, analyze technical and procedural issues, develop practical mitigations, and follow corrective actions through completion.
Strong written and verbal communication skills, including the ability to coordinate across technical teams, security personnel, program stakeholders, and management.

Responsibilities

Develop, implement, maintain, and review information systems security policies, procedures, and plans in accordance with applicable requirements, including 32 CFR Part 117 / NISPOM, DAAPM, JSIG, ICD 503, NIST RMF, and STIGs, as applicable to assigned systems and programs.
Coordinate with program and project stakeholders, IA staff, the FSO, CPSOs, and IT and Security personnel to define, implement, and maintain an acceptable information systems security posture.
Lead or support RMF activities for classified information systems, including preparing and maintaining authorization documentation and obtaining and maintaining Authority to Operate (ATO) approvals.
Implement and oversee the IA program for assigned systems and ensure security requirements are incorporated into system operation, administration, and configuration change management.
Identify vulnerabilities, threats, and potential security risks; assess their impact; define and coordinate mitigation actions; and track corrective measures through completion.
Oversee or coordinate investigations into information security incidents and suspected security breaches, document findings, and implement or track corrective actions.
Perform continuous monitoring of information systems, including security event log review and analysis, periodic self-inspections, technical tests, and compliance reviews.
Verify that workstations, servers, network devices, peripherals, and other system components remain configured and operated in accordance with their approved security posture and authorization conditions.
Assess and audit the security configuration and compliance of Windows and Linux operating systems, virtualization environments, network devices, and related infrastructure across peer-to-peer, LAN, and WAN environments.
Develop and maintain disaster recovery and system-restoration plans to support recovery of data and system functionality.
Provide cybersecurity and information assurance guidance, communicate security responsibilities, and educate personnel on applicable security policies and cybersecurity best practices.
Coordinate with relevant stakeholders to maintain required security documentation, address assessment findings, and support audits, inspections, and customer or government reviews.
Perform other job-related duties as assigned.