Information System Security Manager

Capefox•San Antonio, TX

About The Position

Cape Fox subsidiary Cape Fox Federal Integrators (CFFI) is seeking an Information System Security Manager (ISSM) to provide cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone systems and enclaves for a federal government client. The position is contingent upon contract award. The ISSM oversees cybersecurity compliance, Risk Management Framework (RMF) requirements, personnel certification and training verification, privileged access management, and security audits in accordance with applicable DoD policies and directives. The role includes maintaining RMF compliance and valid Authorities to Operate (ATOs), managing cybersecurity documentation and eMASS records, advising senior management and Authorizing Officials on risk and security posture, assessing vulnerabilities and recommending mitigation, supporting audits and inspections, and providing cybersecurity guidance to users and technical personnel. It also includes privileged account audits, certification and training verification, access administration, vulnerability scanning, application security assessments, STIG remediation, IAVM compliance, cloud cybersecurity support, media destruction, and classified equipment and media transport. The ISSM will support cybersecurity working groups, workforce development and compliance reporting, inspection activities, and enterprise IT pilot projects. The role also involves preparing leadership briefings, coordinating metrics, maintaining agreements and security procedures, and evaluating technology initiatives with enterprise-wide applicability.

Requirements

Bachelor of Science degree in Information Technology or Cybersecurity; a copy of the degree must be provided.
At least five years of experience with RMF requirements and cybersecurity services, with no more than three consecutive years of lapse in cyberspace work.
Meet applicable IT or Cybersecurity education, training, and certification requirements under DoDM 8140.03 and current Government directives, regulations, and policies for the assigned role or labor category (DFARS 252.239-7001).
Current, valid Security+ certification.
Intermediate-level Cybersecurity Work Role experience.
Current Secret Clearance.
Authorization to work in the United States as defined by the Immigration Reform Act of 1986.

Responsibilities

Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone systems and enclaves.
Perform ISSM duties under DoD 8140 Cyberwarfare Code 722, including verifying personnel certification and training requirements before elevated system access, maintaining signed Privileged Access Agreements, and auditing privileged accounts.
Advise unit technicians on cybersecurity requirements, solutions, and implementation.
Administer, coordinate, and track compliance with enterprise cybersecurity architecture, strategies, plans, and policies.
Ensure RMF compliance, maintain valid ATOs, keep security documentation current, and provide cybersecurity expertise to supported units.
Review configuration management processes, maintain secure mechanisms, update RMF requirements, and support audits and inspections.
Maintain IT portfolio data and database structures in ITIPS, RMF Workflow, and eMASS.
Maintain ATOs in accordance with applicable security standards and directives, including NIST SP 800-53 Rev. 5, CNSSI 1253 Rev. 4, DoDI 8510.01, and DISAI 270-50-9.
Advise senior management and the Authorizing Official on risk levels, security posture, and changes affecting organizational cybersecurity.
Assess system and enclave threats, vulnerabilities, and technical risks; document findings and recommend mitigations.
Collect and maintain cybersecurity reporting data and manage the digital eMASS system package repository on authorized information systems.
Track systems and enclaves in eMASS, maintain ATOs, and manage security controls and assessment procedures in coordination with the TSRL IT lead while protecting other team members’ data.
Develop, distribute, and maintain security plans, instructions, SOPs, Body of Evidence documents, System Security Plans, SARs, POA&Ms, risk assessments, topology diagrams, and hardware and software inventories.
Establish and track remediation plans for vulnerabilities identified through risk assessments, audits, and inspections.
Maintain ATO/eMASS artifacts for semiannual inspection and upload required documentation changes within three business days.
Maintain STIG checklists and implement documented remediation actions for audit and inspection findings.
Support internal and external Government cybersecurity audits, inspections, and assessments.
Use ACAS or other Air Force-approved scanning tools to evaluate scan results and identify vulnerabilities.
Conduct application vulnerability assessments and technical and nontechnical risk assessments across relevant technologies, applications, and software.
Implement IAVM dissemination, reporting, and compliance procedures.
Apply cybersecurity strategies to cloud service and deployment models and ensure users complete required cybersecurity training for continued network access.
Maintain onboarding and offboarding SOPs, manage DD Form 2875 submission and routing, and coordinate organizational user accounts.
Schedule and complete quarterly media destruction in accordance with Air Force and local policies.
Attend required in-person or virtual cybersecurity meetings and document minutes supporting RMF requirements.
Support system discovery, categorize systems for eMASS entry, develop compliant cybersecurity solutions and organizational security policies, and assist with hardware and software entry and exit requirements.
Maintain MOAs, MOUs, and AOR letters; update them annually and conduct full reviews every three years.
Transport classified equipment and media to approved TSRL destinations in accordance with applicable security regulations.
Track and report certification requirements for applicable TSRL personnel and participate in DoD 8140.03 teleconferences and meetings as required.
Coordinate with the Government lead to develop compliance metrics and briefings.
Support the CSWG and participate in monthly video teleconferences; conduct roll calls, record minutes, track action items, and facilitate projects.
Gather requirements and help develop processes, concepts of operations, implementation standards, and cybersecurity policies.
Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on S&T IT and cybersecurity initiatives and recommendations.
Respond to user questions about cybersecurity and related technical topics, explain processes and policies, and recommend secure configurations and implementation approaches.
Support the Inspection Functional Lead for the Communications functional area during pre-inspection and post-inspection activities.
Support research, selection, implementation, and operation of enterprise-wide IT pilot and exploratory projects.
Support technology initiatives involving cybersecurity, virtualization, collaborative systems, multiplatform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services.
Collect metrics and prepare reports assessing project outcomes, efficiency, capability improvements, and cybersecurity benefits.