Information System Security Manager

Peraton•Silver Spring, MD

2d•Onsite

About The Position

Peraton is seeking an Information System Security Manager to support Peraton Labs’ information assurance and information technology operations. This is a full-time, on-site position based in the Silver Spring, Maryland office. The role leads information assurance efforts and manages systems across multiple environments, including classified Linux and Microsoft systems. The manager performs ISSM duties under applicable regulations, maintains Risk Management Framework documentation, and oversees security controls, continuous monitoring, vulnerability remediation, and system authorization activities throughout the information system lifecycle. The position also works with stakeholders, system owners, and program managers to maintain security posture and meet customer requirements.

Requirements

At least 8 years of experience with a bachelor’s degree, or at least 6 years with a master’s degree; an additional 4 years of experience may be considered in lieu of a degree.
CISSP or equivalent certification meeting DoDM 8140.03 IAM Level III.
Experience with SAP and/or DCSA assessments and authorizations.
At least 5 years of experience with the ATO process, continuous monitoring, POA&Ms, Security Authorizations, NIST 800-37, NIST 800-53 Rev. 4 or Rev. 5, and working with Information System Owners and Program Managers.
Experience with SCAP, STIGs, and other compliance tools.
Strong written and verbal communication skills and ability to work effectively with team members.
Active TS clearance and ability to obtain SCI.

Nice To Haves

A degree in a technical discipline such as computer science, cybersecurity, or information technology.
Experience with Ongoing Authorizations.
Experience with eMASS.
Experience with ACAS, Nessus, and/or other vulnerability scanners.
At least 3 years of Linux system administration experience, particularly with Ubuntu and Red Hat distributions.
Experience writing Linux shell scripts and troubleshooting existing code.
In-depth knowledge of TCP/IP and networking concepts, including services such as DHCP, DNS, SSH, TLS, and IPSec.
Experience conducting risk assessments and creating Risk Assessment Reports.
Involvement in or knowledge of incident response activities and coordination.

Responsibilities

Lead and manage information assurance efforts and systems across environments in Silver Spring, Maryland.
Perform ISSM duties in accordance with the DAAG, JSIG, ICD-503, and other applicable regulations.
Create, manage, and maintain RMF package documentation, submissions, and artifacts, including A&A packages, ASA packages, and SCRs.
Prepare, deliver, and update required documentation using approved templates, forms, regulations, and methods.
Meet continuous monitoring requirements, including weekly audits, backups, antivirus updates, operating system patching, vulnerability scanning, and other prescribed tasks.
Manage security vulnerabilities, implement timely remediation, monitor security logs for violations and anomalous events, and report information security concerns and problems as needed.
Generate POA&Ms for non-compliant controls, manage them throughout the information system lifecycle, and maintain associated documentation.
Oversee management and maintenance of classified Linux and Microsoft systems, assisting with system builds, software installation, and troubleshooting systems and network devices when needed.
Apply security controls based on DoD Security Technical Implementation Guidance and customer requirements, and work with stakeholders to identify additional applicable controls.
Assist with incident response, annual self-inspections, and inventory efforts.
Track deployment of applicable software and hardware to classified environments.
Track and report security requirements throughout the lifecycle of information systems within the accreditation boundary.
Respond to user and customer requests in a timely and detailed manner.
Maintain current knowledge of corporate policies, security control plans, system configurations and architecture, installed software, accounts, data flows, ports, protocols, and other relevant system information.
Maintain required certifications for the role.
Ensure Configuration Control Board system reviews are scheduled and communicate issues and updates to the Information System Owner.
Ensure cybersecurity self-inspections are conducted annually.