Information Systems Security Manager

Orchard • Palo Alto, CA

1d • $143,000 - $238,000 • Onsite

About The Position

@Orchard LLC is seeking an Information Assurance Manager (IAM) / Information Systems Security Manager (ISSM) to support a portfolio of classified programs covering Collateral and Sensitive Compartmented Information (SCI). The role is based in Palo Alto, California, and supports the full life cycle of information systems, from scoping systems for new programs and preparing accreditation and certification packages to maintaining and monitoring operational systems, managing upgrades, and decommissioning and de-certifying systems.

The ISSM ensures information systems meet applicable government security policies and requirements across multiple business areas or programs. The role includes maintaining system security documentation and controls, coordinating with government agencies and internal stakeholders, leading security professionals, and overseeing security activities such as incident response, insider-threat coordination, media handling, physical security integration, COMSEC accountability, and TEMPEST/EMSEC compliance where applicable.

The position requires U.S. citizenship, an active TS/SCI clearance with CI Poly, a bachelor’s degree or equivalent additional experience, and substantial IT security experience in classified environments. The California base salary range is $143,000–$238,000 annually. The role is incentive-eligible, and eligible employees receive paid time off, health and welfare insurance, and a 401(k).

Requirements

• U.S. citizenship and an active TS/SCI clearance with CI Poly.
• Experience as an ISSM or ISSO implementing NISPOM Chapter 8, ICD 503, and/or JSIG information systems requirements in an SAP/SCI environment.
• CISSP and CISM certifications.
• Ability to obtain GSLC certification within six months of hire.
• Bachelor of Science degree; four additional years of experience may be substituted for a degree.
• Eight years of related IT security experience.
• At least two years of related IT or security experience in a classified SCI environment.
• Hands-on experience with SIEM tools such as Splunk, Elastic, or similar for log analysis and security event correlation.
• Knowledge of information security or information technology standards.
• Experience with the Risk Management Framework (RMF), including participation in assessment and authorization activities.
• Experience conducting security audits and vulnerability assessments in operational classified systems.
• Department of Defense Directive 8140/8570 certification, such as CompTIA Security+ CE or an equivalent certification.
• Experience coordinating with government assessment teams, including DCSA, NSA, or Program Security Officers.

Nice To Haves

• Experience with RMF workflow management solutions such as XACTA, eMASS, or ServiceNow.
• Familiarity with implementing government directives and policies derived from NIST, CNSSI, ICD, DoD, or other government regulatory compliance standards in a professional industry.
• Experience with information security tools for audit reduction, vulnerability management, change detection, and network monitoring, such as ACAS, Nessus, HBSS, Splunk, RedSeal, Tripwire, DISA SCC, and STIG Viewer.
• Experience developing information systems security plans, policies, and procedures for LAN and WAN information systems.
• Experience with Windows and Linux operating environments.
• Previous leadership experience.
• Experience managing security incidents and coordinating response activities in classified environments.
• Knowledge of DevSecOps practices and secure software development lifecycles in classified systems.
• Experience with insider-threat detection tools and procedures.

Responsibilities

• Ensure information system compliance across multiple business areas or programs and compliance with applicable government security policies.
• Provide configuration management and assess the impact of system modifications and vulnerabilities.
• Apply NIST 800-53 controls to systems and document their implementation in Security Controls Traceability Matrices (SCTMs).
• Monitor and resolve Plans of Action and Milestones (POA&Ms) to mitigate vulnerabilities on assigned information systems.
• Communicate and coordinate information systems security policy across the organization and work with government agencies on rulings, interpretations, and acceptable compliance deviations.
• Establish, document, implement, and monitor the facility’s information systems security program and related procedures.
• Prepare and maintain Systems Security Plans (SSPs), verify their implementation and controls, and ensure systems function as described in the SSPs.
• Evaluate proposed SSP changes or additions and collaborate with customers to obtain system approvals.
• Conduct ongoing security reviews and tests to verify that system security features and operating controls are functional and effective.
• Ensure periodic self-inspections of the facility’s information systems program are conducted.
• Develop, document, and present information systems security education, awareness, and training for management, personnel, users, and others as appropriate.
• Ensure personnel are trained on system security restrictions and safeguards before receiving system access.
• Report compliance metrics to the government CSA, program management, and information system owners.
• Manage, lead, and provide security guidance and mentoring to a team of security professionals.
• Oversee and coordinate insider-threat program activities for assigned systems in collaboration with the Insider Threat Program Manager.
• Ensure proper sanitization, destruction, and accountability of classified media and system components throughout the system lifecycle and during decommissioning.
• Coordinate security incident response for assigned systems, including timely reporting to government agencies and internal stakeholders.
• Oversee integration of physical security with information systems security requirements in coordination with facility security personnel.
• Manage COMSEC material accountability and cryptographic key management for assigned systems as applicable.
• Ensure compliance with TEMPEST/EMSEC requirements for SCI-level systems as applicable.

Benefits

• Paid time off.
• Health and welfare insurance.
• 401(k).
• Incentive-eligible compensation, with the target based on contribution, company performance, and/or individual results.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior