Information System Security Manager

Potawatomi Federal Solutions•Hill AFB, UT

3d•Onsite

About The Position

The Information Systems Security Manager (ISSM) serves as the cybersecurity subject matter expert responsible for leading cybersecurity, Risk Management Framework (RMF), Authorization to Operate (ATO), vulnerability management, and continuous monitoring activities supporting U.S. Air Force mission systems and infrastructure. The position provides technical and compliance leadership across program cybersecurity activities and serves as a primary cybersecurity interface between program leadership, engineering and operations teams, customers, and Authorizing Official (AO) stakeholders. The ISSM is responsible for managing multiple system authorization packages, including program and customer ATOs, and ensuring systems maintain an acceptable cybersecurity posture throughout the system lifecycle. The position leads implementation of DoD and Department of the Air Force cybersecurity requirements, including DoD RMF, NIST SP 800-53, DISA Security Technical Implementation Guides (STIGs), vulnerability management, continuous monitoring, and associated cybersecurity documentation. This position also provides cybersecurity leadership supporting modernization of legacy Air Force infrastructure and transition of services to approved hosting and cloud environments.

Requirements

Bachelor's Degree in Cybersecurity or IT related field.
Must have relevant Air Force Risk Management Framework (RMF) experience.
Must meet applicable DoD 8140 qualification requirements at time of hire.
10 or more years experience in cybersecurity, information assurance, cybersecurity engineering, or related disciplines.
Significant experience serving as an ISSM, senior ISSO or comparable cybersecurity authority within a DoD environment.
Demonstrated experience managing systems through the complete RMF lifecycle and obtaining or maintaining ATOs.
Experience managing multiple concurrent authorization packages and coordinating cybersecurity requirements across multiple system owners or customers.
Demonstrated experience with NIST SP 800-53 security controls, eMASS, POA&M management, continuous monitoring, ACAS/Tenable, vulnerability management, and DISA STIGs.
Experience communicating cybersecurity risk and authorization status to technical teams, customers, assessors, and program leadership.
Expert knowledge of DoD Risk Management Framework processes, NIST SP 800-53 security controls, and Department of the Air Force cybersecurity requirements.
Advanced knowledge of system authorization, continuous monitoring, security control implementation and assessment, POA&M management, and cybersecurity risk management.
Strong knowledge of DISA STIGs, ACAS/Tenable, eMASS, vulnerability management processes, and DoD cybersecurity compliance requirements.
Working knowledge of enterprise infrastructure, networking, operating systems, virtualization, and cloud/hosted environments sufficient to assess cybersecurity risk and control implementation.
Strong leadership and organizational skills with the ability to establish cybersecurity priorities across multiple simultaneous authorization and operational efforts.
Advanced RMF, ATO, vulnerability management, STIG, and cybersecurity risk analysis skills.
Strong written communication and technical documentation skills, including the ability to develop and review authorization artifacts and communicate cybersecurity risk to technical and nontechnical stakeholders.
Strong interpersonal and stakeholder-management skills with the ability to work effectively with customers, government personnel, engineers, system administrators, cybersecurity personnel, and program leadership.
Ability to lead cybersecurity activities across engineering, operations, sustainment, customer, and program management organizations.
Ability to independently evaluate cybersecurity risk and provide technically sound recommendations to program and customer leadership.
Ability to manage multiple concurrent ATO and continuous monitoring efforts while prioritizing activities based on mission impact and cybersecurity risk.
Ability to interpret cybersecurity requirements and translate them into actionable technical and program requirements.
Ability to balance operational mission requirements with DoD cybersecurity, authorization, and risk-management requirements.

Nice To Haves

Certified Information Security Manager (CISM)
Certified Information Systems Security Professional (CISSP)

Responsibilities

Provides technical leadership, direction, prioritization, and oversight for cybersecurity activities across the program.
Coordinate cybersecurity activities across ISSOs, security engineers, system administrators, infrastructure teams, application teams, program management, customers, and other mission stakeholders.
Manage multiple systems through the complete DoD Risk Management Framework lifecycle and maintain Authorization to Operate (ATO) packages within eMASS.
Lead development, maintenance, and execution of program ATO packages and two customer ATO packages, including security controls, implementation statements, artifacts, assessment evidence, POA&Ms, continuous monitoring requirements, and authorization documentation.
Serve as a primary cybersecurity point of contact for customer security organizations, assessors, Authorizing Official representatives, and other authorization stakeholders.
Interpret and implement DoD RMF, NIST SP 800-53, Department of the Air Force, DISA, and applicable cybersecurity requirements across program systems and authorization boundaries.
Develop and maintain system security documentation, including System Security Plans, continuous monitoring documentation, control implementation evidence, security procedures, risk documentation, and other RMF artifacts.
Lead vulnerability management activities, including ACAS/Tenable scanning, vulnerability analysis, remediation prioritization, POA&M management, risk acceptance activities, and coordination of remediation efforts with infrastructure and sustainment teams.
Oversee DISA STIG implementation and compliance activities, including STIG checklist development, validation of findings, documentation of applicability, and coordination of remediation with technical system owners.
Monitor cybersecurity compliance and system security posture through continuous monitoring, vulnerability assessments, security control reviews, and analysis of technical and operational risk.
Provide cybersecurity risk assessments and recommendations to Program Management and customer leadership, translating technical vulnerabilities and compliance deficiencies into mission and program risk.
Develop, maintain, and communicate cybersecurity risks within the program risk register and coordinate mitigation strategies with Program Management and technical stakeholders.
Support system architecture, data flow mapping, system boundary definition, network topology analysis, and cybersecurity requirements associated with modernization and hosting/cloud migration activities.
Evaluate proposed system changes, architectures, software, hardware, and technical solutions for cybersecurity and RMF impacts.
Coordinate security patching, vulnerability remediation, and configuration management activities with infrastructure and sustainment teams.
Provide cybersecurity guidance and mentorship to program cybersecurity personnel and technical teams and establish priorities for cybersecurity activities based on mission risk and authorization requirements.
Represent program cybersecurity status, risks, authorization progress, and significant issues during customer, technical, and program leadership meetings.