Information System Security Manager (ISSM)

ARA • Albuquerque, NM

4d • $130,000 - $150,000

About The Position

Applied Research Associates, Inc. (ARA), through its Defense Technology Solutions Division, is hiring an Information System Security Manager (ISSM) for its Albuquerque, New Mexico facility. The ISSM implements, manages, and oversees the classified information system security program at the facility, ensuring systems comply with the NISPOM Rule, the DCSA Assessment and Authorization Guide (DAAG), NIST SP 800-53, CNSSI 1253, and applicable cybersecurity requirements. Appointed under 32 CFR Part 117 §117.7(b)(5), the ISSM is the principal advisor on security matters for systems under their purview and is primarily responsible for implementing the Risk Management Framework (RMF).

The role coordinates closely with the facility FSO, Insider Threat Program Senior Official (ITPSO), ISSOs, DCSA Information Systems Security Professionals, and IT support staff. It oversees the RMF lifecycle and authorization documentation for classified systems, supervises site-level ISSOs and support staff carrying out NISP-related security functions, and leads facility-level response to classified information system security incidents. The ISSM also supports DCSA security reviews and participates in corporate security activities.

ARA is an employee-owned international research and engineering company founded in 1979. It employs more than 2,200 professionals and operates offices in the United States and Canada. Its work spans defense and civil technologies, software and simulation, systems analysis, environmental technologies, and testing and measurement. ARA describes its culture as challenging, innovative, and supportive of employee ownership, autonomy, training, and growth.

Requirements

• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field, or an equivalent combination of education and directly related experience.
• Security+ certification.
• 5–7 years of experience in information system security, including at least 2 years in an ISSM, ISSO, or equivalent role supporting classified information systems.
• Working knowledge of 32 CFR Part 117 §117.18, the DCSA Assessment and Authorization Guide (DAAG), and NIST 800-series publications.
• Experience managing the authorization and accreditation (A&A) lifecycle for classified information systems under DCSA cognizance.
• Active Top Secret clearance with SCI eligibility, or ability to obtain it, or clearance commensurate with the highest classification level processed on facility systems.
• Technical knowledge of Windows and/or Linux security hardening, STIG application, network security fundamentals, and audit log management.
• Experience with classified system configuration management, media control, and sanitization and destruction procedures.
• Technical understanding of classified system security controls, network architecture, and risk management.
• Knowledge of NISPOM and related CFRs, DAAG, NIST publications, and CNSSI directives.
• Analytical thinking, technical writing, and ability to produce clear security documentation such as SSPs, POA&Ms, and incident reports.
• Ability to collaborate effectively with the FSO, ITPSO, IT staff, program managers, and DCSA ISSPs.
• Discretion and integrity in handling classified information and sensitive cybersecurity data.
• Commitment to ongoing professional development and keeping current with cybersecurity threats and DCSA guidance.

Nice To Haves

• DoD 8570.01-M / DoD 8140-compliant certification at IAM Level II or higher, such as CISSP, CISM, CAP, or CASP+.
• Prior industry ISSM, ISSO, or cybersecurity assessor experience with DCSA, NSA, or the Intelligence Community.
• Knowledge of cross-domain solutions, classified cloud environments (IL4/IL5), and network interconnection security.
• Experience with eMASS or equivalent A&A workflow tools, vulnerability scanners, SIEM/auditing tools, and STIG Viewer / SCAP compliance tools.

Responsibilities

• Implement and manage the facility’s classified information system security program in accordance with 32 CFR Part 117 §117.18 and the DAAG.
• Maintain productive working relationships with DCSA ISSPs and promptly respond to assessment findings and information requests.
• Develop, maintain, and submit System Security Plans (SSPs), security control assessments, and authorization packages for classified systems.
• Manage the full RMF lifecycle of classified systems and ensure they operate within DCSA-approved security plans.
• Complete RMF packages in eMASS within DCSA timelines for authorization, reauthorization, extension, and decommission workflows.
• Supervise site-level ISSOs and support staff performing NISP-related security functions.
• Conduct security control assessments, continuous monitoring, and self-inspections of classified information systems.
• Manage the facility’s POA&M for classified systems and track findings through timely resolution.
• Evaluate compliance with configuration management and change control processes before system modifications are implemented.
• Lead facility-level classified information system security incident response and coordinate external reporting through the FSO and corporate security.
• Develop and deliver annual role-based training for classified system users and administrators.
• Provide technical guidance on configuration, hardening, patching, and maintenance of classified systems, networks, and enclaves.
• Help oversee sanitization and destruction of classified media and equipment in accordance with NSA/CSS guidelines.
• Participate in corporate ISSM working groups and internal security reviews.
• Support the FSO during DCSA security reviews by providing classified information system documentation, compliance evidence, and technical briefings.
• Coordinate incident response, including digital evidence preservation and coordination with the FSO, ITPSO, and government agencies.
• Manage individuals and work within a small team to complete projects on schedule.

Benefits

• ARA offers competitive benefits intended to address employees’ needs now and in the future.
• Employee Stock Ownership Plan (ESOP).
• ARA provides employees with tools, training, opportunities, and autonomy.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior