Information Systems Security Manager (ISSM) I

gTANGIBLE Corporation•Bedford, MA

5d•Onsite

About The Position

The Information Systems Security Manager (ISSM) I serves as a principal advisor on technical and other matters involving the security of information systems under their purview. The role primarily supports Special Access Programs (SAPs) for Department of Defense agencies, including HQ Air Force, the Office of the Secretary of Defense, and Military Compartment efforts. It provides day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and SAP activities. The ISSM oversees information-system security policies and programs, with particular emphasis on integrating existing SAP network infrastructures and applying the Risk Management Framework (RMF) and Joint Special Access Program Implementation Guide (JSIG) authorization process. The role advises customers and government program managers on assessments, authorization, security testing, and risk; reviews and recommends authorization documentation; and develops and maintains security policies, procedures, training, incident response, configuration management, and assessment processes. The ISSM also ensures authorization boundaries and documentation remain properly protected, current, and accessible, and performs Information System Security Officer (ISSO) duties when an ISSO is unavailable. The position is full-time and located in Bedford, Massachusetts. It requires a Top Secret/SCI clearance, SAP Information eligibility, and consent for a counterintelligence polygraph. Candidates must meet the applicable DoD Directive 8570.01-M certification requirement within six months of hire and must be able to regularly lift up to 50 pounds.

Requirements

A bachelor's degree in a related area and 5–7 years of related experience, or an associate degree and 7–9 years of experience, or 9–11 years of related experience without a degree.
Prior performance in a role such as ISSO or ISSM.
Meet DoD Directive 8570.01-M certification requirements for Information Assurance Technician Level II or Information Assurance Manager Level I within six months of hire.
Working knowledge of DoD, National, and applicable service and agency security policies, manuals, and standards.
Top Secret/SCI clearance, SAP Information eligibility, and consent for a counterintelligence polygraph.
Ability to regularly lift up to 50 pounds.

Nice To Haves

SAP experience desired.

Responsibilities

Oversee the development, implementation, and evaluation of information-system security program policy, emphasizing integration of existing SAP network infrastructures.
Develop and oversee operational information-system security implementation policies and network-security guidelines based on the RMF, with emphasis on the JSIG authorization process.
Advise customers on RMF assessment and authorization issues and perform risk assessments and make recommendations to DoD agency customers.
Advise government program managers on security testing methodologies and processes.
Evaluate authorization documentation and provide written authorization recommendations to government program managers.
Develop and maintain a formal Information Systems Security Program.
Ensure information assurance officers, network administrators, and other cybersecurity personnel receive the technical and security training needed for their duties.
Develop, review, endorse, and recommend action by the Authorizing Official (AO) or Designated Authorizing Official (DAO) on system assessment documentation.
Ensure approved procedures are in place for clearing, sanitizing, and destroying hardware and media.
Develop and execute security assessment plans, including verification that required protection-level features and assurances function.
Maintain a repository for system authorization documentation and modifications.
Institute and implement a Configuration Control Board (CCB) charter.
Develop incident-response policies and procedures, including investigation and reporting of security violations and incidents.
Ensure appropriate protection or corrective measures are taken when a system incident or vulnerability is discovered.
Ensure data ownership and responsibilities are established for each authorization boundary, including accountability, access rights, and special handling requirements.
Ensure development and implementation of an information-security education, training, and awareness program, including attending, monitoring, and presenting local cybersecurity training.
Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
Assess system, environmental, and operational changes that could affect authorization.
Ensure valid authorization determinations are in place for all authorization boundaries under the ISSM's purview.
Review AIS assessment plans.
Coordinate with the PSO or cognizant security official on approval of external information systems, such as guest systems or systems interconnected with another organization.
Conduct periodic assessments of the security posture of authorization boundaries.
Ensure security-relevant software, hardware, and firmware changes are managed through configuration management and properly documented.
Ensure periodic testing evaluates information-system security posture using intrusion, attack-detection, and monitoring tools, in shared responsibility with ISSOs.
Ensure system recovery and reconstitution processes are developed and monitored so authorization boundaries can be recovered according to their availability-level determinations.
Ensure authorization documentation is current and accessible to properly authorized individuals.
Ensure system security requirements are addressed throughout all phases of the system life cycle.
Develop Assured File Transfers (AFT) in accordance with the JSIG.
Perform ISSO duties when an ISSO is not present or available.