Information System Security Manager (ISSM)

ARA Career • Albuquerque, NM

3d • Onsite

About The Position

Applied Research Associates, Inc. (ARA), through its Defense Technology Solutions Division, is hiring an Information System Security Manager (ISSM) for its Albuquerque, New Mexico facility. The ISSM implements, manages, and oversees the classified information system security program at the facility, ensuring systems comply with the NISPOM Rule, the DCSA Assessment and Authorization Guide (DAAG), NIST SP 800-53, CNSSI 1253, and applicable cybersecurity requirements. Appointed under 32 CFR Part 117 §117.7(b)(5), the ISSM leads implementation of the Risk Management Framework (RMF) and serves as the principal advisor on security matters for systems under their purview.

The role works closely with the Facility Security Officer (FSO), Insider Threat Program Senior Official (ITPSO), Information System Security Officers (ISSOs), DCSA Information Systems Security Professionals (ISSPs), and facility IT support staff. It includes supervising site-level ISSOs and support staff, managing the RMF lifecycle and authorization documentation, conducting assessments and continuous monitoring, and leading the facility response to classified information system security incidents.

ARA is an employee-owned international research and engineering company founded in Albuquerque in 1979, with more than 2,200 professionals and offices throughout the United States and Canada. The company describes its culture as one where innovation and experimentation are the norm and employees have tools, training, opportunities, and autonomy to contribute as employee owners.

Requirements

• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field; an equivalent combination of education and directly related experience will be considered.
• Security+ certification.
• Five to seven years of experience in information system security, including at least two years in an ISSM, ISSO, or equivalent role supporting classified information systems.
• Working knowledge of 32 CFR Part 117 §117.18, the DCSA Assessment and Authorization Guide (DAAG), and NIST 800-series publications.
• Experience managing the assessment and authorization lifecycle for classified information systems under DCSA cognizance.
• Active Top Secret clearance with SCI eligibility, ability to obtain it, or clearance commensurate with the highest classification level processed on facility systems.
• Strong technical knowledge of Windows and/or Linux security hardening, STIG application, network security fundamentals, and audit log management.
• Experience with classified system configuration management, media control, and sanitization/destruction procedures.
• Technical understanding of classified system security controls, network architecture, and risk management.
• Knowledge of NISPOM and related CFRs, DAAG, NIST special publications, and CNSSI directives.
• Analytical thinking, technical writing, and ability to produce clear security documentation such as SSPs, POA&Ms, and incident reports.
• Incident response leadership, including digital evidence preservation and coordination with the FSO, ITPSO, and government agencies.
• Ability to collaborate effectively with the FSO, ITPSO, IT staff, program managers, and DCSA ISSPs.
• Discretion and integrity in handling classified information and sensitive cybersecurity data.
• Commitment to continuous professional development and keeping current with cybersecurity threats and DCSA guidance.
• Ability to manage individuals and work in a small team to complete projects on set deadlines.

Nice To Haves

• DoD 8570.01-M / DoD 8140-compliant certification at IAM Level II or higher, such as CISSP, CISM, CAP, or CASP+.
• Prior industry ISSM, ISSO, or cybersecurity assessor experience with DCSA, NSA, or the Intelligence Community.
• Knowledge of cross-domain solutions, classified cloud environments (IL4/IL5), and network interconnection security.
• Experience with eMASS or equivalent A&A workflow tools, vulnerability scanners, SIEM/auditing, and STIG Viewer / SCAP compliance tools.

Responsibilities

• Implement and manage the facility’s classified information system security program in accordance with 32 CFR Part 117 §117.18 and the DAAG.
• Maintain productive working relationships with DCSA ISSPs and respond promptly to assessment findings and information requests.
• Develop, maintain, and submit System Security Plans (SSPs), security control assessments, and authorization packages for classified systems.
• Manage the RMF lifecycle of classified systems and ensure they operate within DCSA-approved security plans.
• Complete RMF packages in eMASS within DCSA timelines for authorization, reauthorization, extensions, and decommissioning workflows.
• Supervise site-level ISSOs and support staff performing NISP-related security functions.
• Conduct security control assessments, continuous monitoring, and self-inspections of classified information systems.
• Manage the facility’s POA&Ms and track findings through timely resolution.
• Evaluate and ensure compliance with configuration management and change control processes before system modifications are implemented.
• Lead facility-level response to classified information system security incidents and coordinate external reporting through the FSO and corporate security.
• Develop and deliver annual role-based training for classified system users and administrators.
• Provide technical guidance on configuration, hardening, patching, and maintenance of classified systems, networks, and enclaves.
• Help oversee sanitization and destruction of classified media and equipment in accordance with NSA/CSS guidelines.
• Participate in corporate ISSM working groups and internal security reviews.
• Support the FSO during DCSA security reviews by providing classified information system documentation, compliance evidence, and technical briefings.

Benefits

• Competitive benefits addressing employees’ needs now and in the future.
• Employee Stock Ownership Plan (ESOP).
• Tools, training, opportunities, and autonomy for employees to take active roles as employee owners.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior