Information System Security Manager - ISSM
About The Position
The Information System Security Manager (ISSM) supports and oversees Ohio State University’s National Security Program cybersecurity compliance, system integrity, classified data protection, and cryptographic security across national security and classified research initiatives. The role supports the development, implementation, accreditation, and continuous monitoring of information systems, and manages the control, accountability, and operational oversight of Communications Security (COMSEC) materials, cryptographic equipment, Controlled Cryptographic Items (CCI), and keying material. Compliance responsibilities include applicable federal cybersecurity standards and national security directives, including DoD RMF, NIST SP 800-53, NIST SP 800-171, DoD CMMC, DAAPM, NISPOM, NSA COMSEC policies, and CNSSI directives. The ISSM oversees System Security Plans (SSPs), security control validation, vulnerability remediation, and cryptographic hardware lifecycle management. The role conducts audits and vulnerability assessments using tools such as Nessus/Tenable, Splunk, SCAP Compliance Checker, and DISA STIGs, and maintains accounting records in government tracking databases such as eMASS and electronic key management systems (KMI/EKMS). The ISSM is the primary contact for external security inspections, tests, command audits, and reviews by oversight authorities such as DCSA. The position works with system owners, control assessors, Authorizing Officials, privileged users, technical teams, the Sr. FSO, CISO, and institutional research leadership to enforce compliance, assess third-party RMF packages, investigate technical anomalies or COMSEC compromises, and maintain secure operations. The role reports to the Sr. Facility Security Officer (Sr. FSO). Most duties require presence on campus, though hybrid arrangements may be considered.
Requirements
- Bachelor’s degree in Computer Science, Cyber Security, Engineering, Information Technology, Software Engineering, or an equivalent combination of education and experience.
- Six years of relevant experience.
- U.S. citizenship and active national security clearance eligibility at the final Secret level or higher, or eligibility to receive a clearance.
- At least two years of direct experience in information security roles managing DoD RMF, DAAPM, or NISPOM compliance frameworks.
- Experience developing and maintaining RMF packages, including System Security Plans (SSPs), Security Control Traceability Matrices (SCTMs), and Plans of Action and Milestones (POA&Ms).
- Familiarity with NIST SP 800-53 and NIST SP 800-171.
- Experience with security tools and enterprise tracking databases, including eMASS, Nessus, Splunk, SCAP Compliance Checker, DISA STIGs, KMI, or EKMS.
- Strong technical background across networking components, operating systems, and privileged user management.
- Strong verbal and written communication skills, including the ability to articulate technical risks, author SOPs and security policies, and collaborate effectively with diverse stakeholders.
- Attention to detail.
Nice To Haves
- Eight or more years of relevant experience.
- Two years of experience in COMSEC specialty programs, procedures, key management policies, and asset control.
- Technical familiarity with cryptographic equipment such as TACLANE, KG/KY/KIV devices, fill devices, and secure telephony systems.
- Experience preparing systems to meet requirements for a NIST SP 800-171 or NIST SP 800-53 assessment.
- Experience defining and documenting system boundaries and data flows.
- DoD 8570 / 8140 IAM Level II or III certification, such as CISSP, CISM, GSLC, or CASP+ CE.
- Completion of DAAPM Section 3.6 ISSM Required Training through the Center for Development of Security Excellence (CDSE).
- Five or more years of cybersecurity experience within classified DoD or Intelligence Community environments.
- Formal completion of the NSA / DoD COMSEC Custodian Course and KMI / EKMS Training.
Responsibilities
- Support and oversee cybersecurity compliance for Ohio State University’s National Security Program.
- Support the development, implementation, accreditation, and continuous monitoring of information systems.
- Manage and oversee COMSEC materials, cryptographic equipment, Controlled Cryptographic Items, and keying material, including their control, accountability, and operation.
- Oversee System Security Plans, security control validation, vulnerability remediation, and cryptographic hardware lifecycle management.
- Conduct system audits and vulnerability assessments using technical security tools.
- Maintain records in government tracking databases and electronic key management systems, including eMASS and KMI/EKMS.
- Serve as the primary contact for external security inspections, tests, command audits, and reviews.
- Work with system owners, control assessors, Authorizing Officials, privileged users, and technical teams to enforce compliance policies.
- Evaluate third-party RMF packages and investigate technical anomalies or COMSEC compromises.
- Collaborate with the Sr. FSO, CISO, and institutional research leadership to maintain accredited operations.
- Articulate technical risks, author SOPs and security policies, and collaborate with diverse stakeholders.
Benefits
- Medical, dental, and vision coverage, with Ohio State paying a significant portion of the cost.
- Paid time off, including sick and vacation time and 11 holidays.
- State retirement plan or an alternative retirement plan, both with generous employer contributions.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
