Information Systems Security Manager (ISSM), JM - PR 1474

Explore Current Openings•Hanscom Air Force Base, MA

11d•Onsite

About The Position

PE Systems, Inc. is hiring an Information Systems Security Manager (ISSM) to support the Nuclear Command, Control, and Communications (NC3) Program at Hanscom AFB, Massachusetts. The role applies broad theoretical and practical engineering knowledge to the planning, design, and implementation of secure and resilient communications and information systems. The ISSM ensures that system and application deliverables comply with applicable National, Federal, Department of Defense, and Department of the Air Force cybersecurity policies and legal requirements, and helps protect the confidentiality, integrity, and availability of systems, networks, and data. The position supports system and application Assessment and Authorization (A&A), including the quality and completeness of Risk Management Framework activities and artifacts. It assesses security risks and vulnerabilities; reviews proposed system changes, technical baselines, security architectures, test plans, and program documentation; and recommends safeguards, policies, and procedures. The ISSM also maintains and prepares RMF and other security documentation, monitors threat information, supports audits and cyber evaluations, and contributes to cybersecurity projects and taskers. Personnel performing cybersecurity activities must maintain qualifications in accordance with the cited DoD and Air Force cyberspace workforce requirements. The role requires a government Top Secret/SCI clearance, proficiency with Microsoft programs, and the ability to perform functional duties independently. The employee must be able to transport themselves to various facility sites as required. If using a personal vehicle, a valid driver’s license and proof of insurance are required. The estimated annual base salary range is $152,000–$162,000. PE Systems notes that offers may consider the position’s scope and responsibilities, candidate experience, education and training, skills, and market and business considerations. The company describes its benefits as including generous PTO, holidays, competitive pay, and outstanding benefits.

Requirements

BA/BS or MA/MS degree.
3–10 years of experience related to the position requirements.
Must possess and maintain a government Top Secret/SCI security clearance.
Proficiency with Microsoft programs, including Excel, Word, and Outlook.
Ability to perform all functional duties independently.
Ability to transport oneself to various facility sites as required.
If using a personal motor vehicle, a valid driver’s license and proof of insurance are required.
Meet the Basic or Intermediate qualification requirements for Information System Security Manager (722) or Vulnerability Assessment Analyst (541), as outlined in DoDI 8140.01, DoDI 8140.02, and DoDM 8140.03.
Perform the applicable Information Systems Security Management (722) and Vulnerability Assessment Analyst (541) core/additional tasks and meet the KSAs outlined in the cited DoD Cyber Workforce Framework guidance.

Responsibilities

Ensure system and application deliverables meet applicable National, Federal, DoD, and Department of the Air Force cybersecurity policies and legal requirements.
Plan, analyze, develop, implement, maintain, and enhance information systems security programs, policies, procedures, and tools to protect systems, networks, and data.
Ensure personnel performing cybersecurity activities obtain and maintain qualifications required by DoDI 8140.02, DoDM 8140.03-M, and AFMAN 17-1303.
Support system and application Assessment and Authorization efforts, including assessing and guiding the quality and completeness of RMF activities, tasks, and artifacts.
Recommend policies and procedures that promote information-system reliability and accessibility and prevent unauthorized access.
Conduct risk and vulnerability assessments and inspections of planned and installed information systems; evaluate threats and vulnerabilities and identify protection needs and safeguards.
Participate in meetings, teleconferences, change control boards, and working groups to keep cybersecurity requirements aligned with technical baselines, security architecture, information flows, system design, and security controls.
Evaluate deficiency reports, problem reports, change requests and proposals, and AF Form 1067s; contribute to root-cause analysis and solution recommendations; assess security impacts of changes; and document revisions to RMF artifacts.
Review modification packages, program and system documents, support-agreement updates, and communications and network infrastructure upgrades for cybersecurity configuration and requirements.
Review system test plans and results and, when necessary, observe testing of security control implementation; document findings in reports.
Perform security impact analyses for system changes and prepare letters of assurance, security impact letters, and risk assessment letters, including applicable exceptions, deviations, and waivers.
Monitor intelligence and open-source information for system vulnerabilities, assess risk, and provide Plan of Action and Milestones (POA&M) recommendations.
Promote security awareness among management and ensure sound security principles are reflected in organizational visions and goals.
Conduct systems security monitoring, evaluations, audits, and reviews; recommend contingency plans and disaster recovery procedures.
Recommend and implement programs to ensure users understand and follow system, network, and data security policies and procedures.
Participate in network and systems design, including cryptographic design, to support appropriate security policy implementation; apply knowledge of cryptography and key management concepts.
Facilitate the gathering, analysis, and preservation of evidence used in the prosecution of computer crimes.
Assess security events, determine their impact, and implement corrective actions.
Apply cybersecurity and cryptographic policies, principles, and practices throughout the system development lifecycle.
Author, monitor, and record system information in applicable databases.
Prepare and record system, security-status, and portfolio-management information in the Air Force Information Technology Investment Portfolio Suite (ITIPS) for FISMA, SISSU, Clinger-Cohen Act, and other statutory compliance.
Author, review, certify, and maintain security management plans and RMF artifacts, including RMF Implementation Plans, System Security Management Plans, Information Support Plans, Program Protection Plans, security analyses, vulnerability and countermeasure analyses, Vulnerability Management Plans, Common Control Packages, security concepts of operations, OPSEC Plans, and Authority-to-Connect guest-system packages.
Support external teams evaluating system cybersecurity posture, including non-regular cyber tests, war games, penetration tests, and studies conducted by organizations such as NSA, DISA, and the Air Force Audit Agency.
Support development, coordination, and implementation of cybersecurity special projects and taskers, including Defensive Cyber Operations and requests or actions from higher headquarters and designated military organizations.
Perform Information Systems Security Management (722) and Vulnerability Assessment Analyst (541) core and additional tasks and meet the associated DoD Cyber Workforce Framework knowledge, skills, and abilities.