ISSM II - Information Systems Security Manager

Watermark Risk Management International•Fort Walton Beach, FL

About The Position

The Information Systems Security Manager II (ISSM) serves as a principal advisor on technical and other matters involving the security of information systems under their purview. The role provides day-to-day security support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities, primarily supporting DoD SAPs and agencies such as HQ Air Force, the Office of the Secretary of Defense, and Military Compartment efforts. The ISSM oversees information systems security programs and authorization activities, including policy development, Risk Management Framework (RMF) implementation, Joint Special Access Program Implementation Guide (JSIG) authorization processes, assessment documentation, risk assessments, security testing, incident response, configuration management, and security education. The role also supports system lifecycle security, authorization-boundary protection and recovery, periodic security assessments, and coordination with government and security stakeholders. The position provides leadership, mentoring, and quality assurance for Cyber Security and Information Technology team members.

Requirements

7–9 years of related experience.
Prior performance in roles such as ISSO or ISSM.
Bachelor’s degree in a related area, or an Associate’s degree in a related area plus 2 years of experience, or equivalent experience (4 years).
IAT Level 3 certification (such as CISSP, CASP+ CE, CCNP Security, or CISA) or IAM Level 3 certification.
Active/current TS/SCI clearance.
Ability to obtain CI Poly.
Some Special Access Program (SAP) experience for Level I and Level II candidates.
Ability to report to a physical location and occasionally traverse between buildings.
Ability to regularly lift up to 50 pounds.
May require sedentary work at least 50% of the time.
Ability to manage stress with a high degree of maturity and professionalism.
Demonstrated critical-thinking and leadership skills, and ability to work well with others.
Effective verbal and written communication skills.

Responsibilities

Oversee development, implementation, and evaluation of information system security program policy, with emphasis on integrating existing SAP network infrastructures.
Develop and oversee operational information systems security implementation policy and network security guidelines based on RMF and the JSIG authorization process.
Advise customers on RMF assessment and authorization issues and perform risk assessments with recommendations for DoD agency customers.
Advise government program managers on security testing methodologies and processes.
Evaluate authorization documentation and provide written recommendations for authorization to government program managers.
Develop and maintain a formal Information Systems Security Program.
Ensure information assurance officers, network administrators, and other cybersecurity personnel receive the technical and security training needed to perform their duties.
Develop, review, endorse, and recommend action by the Authorizing Official (AO) or Designated Authorizing Official (DAO) on system assessment documentation.
Ensure approved procedures are in place for clearing, sanitizing, and destroying hardware and media.
Develop and execute security assessment plans, including verification that required protection-level features and assurances are functioning.
Maintain an applicable repository for system authorization documentation and modifications.
Establish and implement a Configuration Control Board (CCB) charter.
Develop policies and procedures for responding to security incidents, including investigation and reporting of security violations and incidents.
Ensure appropriate protection or corrective measures are taken when a system incident or vulnerability is discovered.
Establish data ownership and responsibilities for each authorization boundary, including accountability, access rights, and special handling requirements.
Ensure implementation of an information security education, training, and awareness program; attend, monitor, and present local cybersecurity training.
Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
Assess system, environmental, and operational changes that could affect authorization.
Ensure valid authorization determinations are in place for all authorization boundaries under the ISSM’s purview.
Review AIS assessment plans.
Coordinate with the PSO or cognizant security official on approval of external information systems, such as guest systems and interconnected systems belonging to another organization.
Conduct periodic assessments of the security posture of authorization boundaries.
Ensure security-relevant software, hardware, and firmware changes are managed through configuration management and properly documented.
Ensure periodic security testing is conducted using intrusion, attack-detection, and monitoring tools, sharing responsibility with ISSOs.
Ensure system recovery and reconstitution processes are developed and monitored so authorization boundaries can be recovered according to their availability-level determination.
Ensure authorization documentation is current and accessible to appropriately authorized individuals.
Ensure system security requirements are addressed throughout all phases of the system life cycle.
Participate in self-inspections and periodically review system security to accommodate policy or technology changes.
Coordinate technical security issues outside the role’s expertise or responsibility with the ISSE.
Provide expert research and analysis for expanding programs and areas of responsibility involving cybersecurity and information technology activities.
Develop Assured File Transfers (AFT) in accordance with the JSIG.
Provide leadership, mentoring, and quality assurance for Cyber Security and Information Technology team members.
Perform additional duties as assigned.