Information System Security Manager (ISSM)

STEM Solutions•Tysons, VA

About The Position

We are looking for a dynamic Information System Security Manager to join our team! The Information System Security Manager (ISSM) serves as the principal advisor to the Authorizing Official (AO) and program leadership on all matters, technical and otherwise, involving the security of assigned information systems. The ISSM is responsible for the development, implementation, and maintenance of the agency's information security program in accordance with the Risk Management Framework (RMF), NIST SP 800-series guidance, and applicable federal and agency-specific security policies. This role oversees a team of Information System Security Officers (ISSOs) and serves as the primary point of contact for security authorization, continuous monitoring, and incident response activities.

Requirements

Active Secret clearance or higher
Minimum 3 years of experience in information systems security, information assurance, or cybersecurity, with direct experience supporting a federal agency
Demonstrated experience serving as an ISSM, ISSO, or equivalent security role within the Risk Management Framework (RMF) or legacy DIACAP/C&A process
Working knowledge of NIST SP 800-37, NIST SP 800-53, NIST SP 800-30, and FISMA reporting requirements
Active DoD Secret security clearance required at time of hire; ability to maintain clearance eligibility for the duration of the contract
Current DoD 8570.01-M / DoD 8140 IAM Level II certification (e.g., CAP, CASP+ CE, CISM, GSLC) at time of hire
Strong written and verbal communication skills, with experience briefing technical risk and compliance matters to government leadership and Authorizing Officials
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent professional experience

Nice To Haves

IAM Level III certification (e.g., CISSP, CISSP-ISSMP, CISM) or equivalent advanced credential
Experience using eMASS, Xacta, or other GRC platforms to manage A&A documentation
Experience supporting defense, healthcare, or civilian federal agency security programs
Familiarity with cloud security authorization processes (FedRAMP) and DevSecOps/continuous ATO practices

Responsibilities

Serve as the principal advisor to the Authorizing Official (AO) and Information System Owner on the security of assigned information systems
Lead and manage the Assessment and Authorization (A&A) process for information systems in accordance with the Risk Management Framework (RMF, NIST SP 800-37), ensuring timely issuance and maintenance of Authorizations to Operate (ATOs)
Develop, review, and maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and other required RMF artifacts
Oversee a team of Information System Security Officers (ISSOs), providing guidance on day-to-day security operations and compliance activities
Conduct and oversee continuous monitoring activities, including vulnerability scanning, configuration management, and security control assessments, to maintain the security posture of authorized systems
Ensure compliance with FISMA, NIST SP 800-53, NIST SP 800-171 (as applicable), CNSSI, and agency-specific cybersecurity policies and directives
Coordinate incident response activities and report security incidents to the appropriate agency SOC/CSIRC and leadership in accordance with established procedures
Manage risk assessments and communicate residual risk to the AO, providing recommendations for risk acceptance, mitigation, or remediation
Ensure personnel supporting assigned systems meet DoD 8570.01-M / DoD 8140 information assurance workforce certification and training requirements
Maintain security documentation in agency GRC/eMASS (or equivalent) systems and support periodic audits, Inspector General (IG) reviews, and independent assessments
Support the development of security policies, procedures, and standard operating procedures (SOPs) to strengthen the agency's overall security program