Sr. Information System Security Manager (ISSM)

Amentum•West Palm Beach, FL

6d•Onsite

About The Position

Amentum is seeking an Information Systems Security Manager (ISSM) for its Atlantic Undersea Test and Evaluation Center (AUTEC) office in West Palm Beach, Florida. This is a full-time, on-site position with no remote capabilities. The ISSM is responsible for the cybersecurity posture of all contractor-operated information systems at AUTEC, encompassing locations in West Palm Beach and Andros Island, The Bahamas. This role guides systems through the DoD Risk Management Framework (RMF), ensures all Authorizations to Operate (ATOs) are current, and serves as the primary cybersecurity point of contact to the Government. The ISSM's accountability extends to enterprise IT, range instrumentation and test-and-evaluation (T&E) systems, Platform IT (PIT), and operational technology supporting undersea testing. A Secret U.S. Government Clearance is required, necessitating U.S. Citizenship.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science or a related field.
At least 8 years of information assurance or cybersecurity experience, including at least 3 years as an ISSM or ISSO on DoD systems.
Hands-on experience taking DoD systems through RMF to an ATO, including authoring the SSP, POA&M and other package artifacts.
CISSP or CISM
Working proficiency in eMASS.
Experience applying DISA STIGs and SRGs, and managing vulnerability remediation with ACAS/Tenable.
Working knowledge of NIST SP 800-37, NIST SP 800-53, CNSSI 1253 and DoDI 8510.01.
Experience managing IAVM compliance and cybersecurity POA&Ms against Government deadlines.
Ability to occasionally travel, live and work on-site at AUTEC, Andros Island, a remote location, and to hold a valid U.S. passport and valid drivers license.
Must be able to obtain and maintain a Secret U.S. Government Clearance. Note: U.S. Citizenship is required to obtain a Secret Clearance.
Strong written and verbal communication, including briefing risk to Government leadership and auditors.

Nice To Haves

Master's degree in Cybersecurity, Information Assurance or a related field.
Active Secret Clearance.
CISSP-ISSMP or CISSP-ISSEP concentration.
CompTIA SecurityX (formerly CASP+), CISM or GIAC GSLC.
PMP or equivalent project management certification.
Experience supporting NAVSEA, NUWC or another Navy warfare center, and working with the Navy AO and Navy Qualified Validators.
Prior ISSM duty on a Government-owned, contractor-operated (GOCO) site or a remote/OCONUS installation.
Experience leading a site through a Command Cyber Readiness or Operational Readiness inspection.
Experience with classified systems, including JSIG, DCSA DAAPM or SAP environments.
Experience securing Platform IT, industrial control systems or range instrumentation and test-and-evaluation systems.
Experience with Splunk or another SIEM, Trellix ESS and Microsoft security tooling.
Familiarity with DoD Zero Trust strategy and capability roadmaps.
Experience with cybersecurity supply chain risk management and cloud authorizations (FedRAMP, DoD Cloud SRG).
Experience supervising a cybersecurity team of three or more.
Experience writing cybersecurity procedures within a corporate business management system.

Responsibilities

Lead all AUTEC systems through the six RMF steps under DoDI 8510.01, from categorization through authorization and continuous monitoring.
Build, maintain and submit authorization packages in eMASS: System Security Plan, security control traceability, risk assessments, POA&Ms and supporting artifacts.
Track ATO expiration dates and start reauthorization early enough that no system operates without a valid authorization.
Coordinate assessments with the Security Control Assessor (SCA) and Navy Qualified Validators, and close findings on schedule.
Assess the security impact of every proposed system change and serve as a voting member of the Configuration Control Board.
Run the continuous monitoring program: scheduled ACAS/Tenable scans, STIG and SRG compliance checks, endpoint security (ESS) reporting and log review.
Track IAVM notices (IAVAs, IAVBs, TAs) and Navy cyber orders to closure, reporting compliance by the required dates.
Own the cybersecurity POA&M: accurate milestones, realistic dates and documented mitigations for every open weakness.
Prepare the site for Command Cyber Readiness/Operational Readiness inspections and other Government audits.
Maintain the site incident response plan and lead the contractor response to cybersecurity incidents and spillages.
Report incidents to the Government ISSM and Navy cyber defense channels within required timelines.
Produce monthly cybersecurity status reports and brief program leadership and the Government on risk.
Supervise, task and develop ISSOs and cybersecurity technicians; verify each holds the DoD 8570/8140 qualification their work role requires.
Manage privileged access: DD Form 2875 (SAAR) processing, privileged user agreements and periodic access reviews.
Run cybersecurity awareness, removable media, and data-at-rest and data-in-transit controls for the site.
Write and maintain cybersecurity policies, standard procedures and continuity plans aligned with DoD, DoN and contract requirements.
Advise engineering and operations on secure design for new range, T&E and network capabilities, including Zero Trust alignment.
Other related duties as assigned.