Information System Security Manager

Bering Straits Native Corp•Colorado Springs, CO

7d•Onsite

About The Position

The Information System Security Manager oversees cybersecurity, information assurance, and Risk Management Framework (RMF) compliance for assigned information systems and programs. The role develops and manages cybersecurity programs that comply with Department of Defense (DoD), Intelligence Community (IC), federal, and organizational requirements, and leads RMF activities throughout the system lifecycle. The position is contingent upon award of contract and has supervisory responsibilities. The manager oversees cybersecurity authorization packages and continuous monitoring; advises program and government leaders on risks and compliance; directs vulnerability management, remediation, security testing, and control implementation across classified and unclassified systems; and supports incident response and investigations. The role also guides cybersecurity personnel, develops policies and training, reports security metrics and risks, participates in technical and program reviews, and ensures personnel follow security policies and training requirements. The position is primarily performed in government facilities, secure operations centers, SCIFs, engineering environments, and offices, in both classified and unclassified settings. It requires maintaining applicable clearances and access authorizations, with possible routine access to information up to the Top Secret/SCI level. Occasional extended hours and travel may be required to support incidents, inspections, accreditation, outages, remediation, assessments, and mission requirements. Applicants are to be notified by email or phone within ten business days regarding application status. As a condition of employment, candidates must pass a pre-employment drug screening and have acceptable background-check results; contract requirements may also require appropriate clearances and access to military installations.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, Mathematics, or a related technical field; additional qualifying experience may substitute for education.
At least 7 years of experience in cybersecurity, information assurance, information security, systems administration, systems engineering, or related technical disciplines.
At least 3 years of experience as an ISSM, ISSO, cybersecurity lead, or in a comparable cybersecurity management role.
Experience implementing and managing RMF for DoD or federal information systems.
Experience developing and maintaining ATO packages and related cybersecurity documentation.
Experience overseeing vulnerability management, compliance assessments, and security-control implementation.
Experience managing cybersecurity compliance for classified and unclassified systems.
Experience leading teams and coordinating cybersecurity activities across multiple organizations.
Strong analytical, leadership, organizational, and communication skills.
Experience briefing cybersecurity risks to senior leadership and government stakeholders.
Must possess or be eligible to obtain and maintain a Top Secret security clearance.
Thorough knowledge of RMF processes and NIST cybersecurity standards, including NIST SP 800-53 and NIST SP 800-37, DoD cybersecurity policies, CNSSI requirements, and IC directives.
Knowledge of system security architecture, network security, cloud security, virtualization, and enterprise cybersecurity operations.
Familiarity with vulnerability management, security assessments, auditing, and continuous-monitoring programs.
Understanding of security engineering principles and lifecycle cybersecurity integration.
Knowledge of incident response, configuration management, and security operations processes.
Ability to analyze complex technical risks and communicate recommendations to leadership.
Strong documentation, policy-development, and technical-writing skills.
Ability to manage multiple projects, systems, and cybersecurity initiatives simultaneously.
Proficiency with Microsoft Office Suite, cybersecurity tools, compliance platforms, and security management systems.
Knowledge of organizational procedures and workflows, relevant technologies or tools, customer-service practices, data privacy and confidentiality principles, and communication, time-management, problem-solving, teamwork, and attention-to-detail skills.
Must pass a pre-employment drug screening and have acceptable background-check results.
Must be able to sit and work at a computer workstation for extended periods, review and approve technical documentation, communicate effectively in meetings and briefings, conduct facility visits and inspections in secure environments, lift up to 20 pounds occasionally, and travel occasionally.
Must maintain a constant state of mental alertness and situational awareness.

Nice To Haves

Active Top Secret clearance with SCI eligibility or current TS/SCI clearance.
DoD 8570/8140 IAT Level III or IAM Level III certification requirements satisfied.
CISSP, CISM, CAP, CASP+, GSLC, SecurityX, or equivalent advanced cybersecurity certification.
Experience supporting Air Force, Space Force, Army, Navy, SOCOM, the Intelligence Community, or other federal government environments.
Experience supporting classified information systems, SCI environments, and Special Access Programs.
Experience managing cybersecurity programs in Azure Government, AWS GovCloud, or hybrid cloud environments.
Knowledge of Zero Trust Architecture implementation and cybersecurity modernization initiatives.
Experience with ACAS, HBSS/ESS, Splunk, Microsoft Defender, eMASS, Xacta, or comparable cybersecurity platforms.
Experience supporting DevSecOps and secure software development initiatives.
Prior experience as an ISSM, Senior ISSO, Cybersecurity Manager, Cybersecurity Program Manager, or Security Architect.
BSNC shareholder, shareholder descendant, or shareholder spouse preference applies to candidates who meet the minimum qualifications.

Responsibilities

Oversee cybersecurity, information assurance, and RMF compliance for assigned information systems and programs.
Develop, implement, and manage the cybersecurity program to meet DoD, IC, federal, and organizational requirements.
Lead RMF activities through system categorization, control implementation, assessment, authorization, continuous monitoring, and risk management.
Prepare, maintain, and submit authorization documentation, including SSPs, SARs, SCTMs, and POA&Ms.
Advise Program Managers, Authorizing Officials, Information System Owners, and senior leadership on cybersecurity risks and compliance requirements.
Manage vulnerability assessment, remediation, continuous monitoring, and cybersecurity risk mitigation.
Ensure compliance with NIST, DoD, CNSSI, ICD, and organizational cybersecurity policies and directives.
Supervise and provide technical guidance to ISSOs, ISSEs, system administrators, and cybersecurity personnel.
Coordinate security testing, vulnerability scanning, penetration testing, audits, and inspections.
Review and approve system security configurations, architecture changes, software implementations, and security-control modifications.
Oversee cybersecurity-control implementation across classified and unclassified information systems.
Support incident response, cybersecurity investigations, root-cause analysis, and corrective-action planning.
Develop cybersecurity policies, procedures, standards, and training programs.
Provide cybersecurity metrics, compliance reporting, and risk briefings to leadership and government customers.
Participate in Configuration Control Boards, technical reviews, engineering working groups, and program management reviews.
Ensure personnel operating information systems comply with security policies, training requirements, and acceptable-use standards.
Maintain required security clearances and access authorizations.
Travel occasionally to support cybersecurity assessments, inspections, and customer requirements.