Information Systems Security Manager (ISSM) I

gTANGIBLE Corporation•Lincoln, MA

7d•Onsite

About The Position

The Information Systems Security Manager (ISSM) I serves as a principal advisor on technical and other matters involving the security of information systems under their purview. The role primarily supports Special Access Programs (SAPs) for Department of Defense agencies, including HQ Air Force, the Office of the Secretary of Defense, and Military Compartment efforts. It provides day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and SAP activities. The ISSM oversees information-system security policy and implementation, with emphasis on integrating existing SAP network infrastructures and applying the Risk Management Framework (RMF) and Joint Special Access Program Implementation Guide (JSIG) authorization process. The position advises government customers and program managers, evaluates authorization documentation, performs risk assessments, and develops and maintains the information-systems security program. It also oversees training, incident response, configuration management, system assessments, authorization documentation, and security requirements throughout the system life cycle. The ISSM performs Information System Security Officer (ISSO) duties when an ISSO is not present or available.

Requirements

Bachelor's degree in a related area and 5–7 years of related experience, or an associate degree and 7–9 years of experience, or 9–11 years of related experience without a degree.
Prior performance in roles such as ISSO or ISSM.
Meet DoD Directive 8570.01-M certification requirements for Information Assurance Technician Level II or Information Assurance Manager Level I within six months of hire.
Working knowledge of DoD, national, and applicable service and agency security policies, manuals, and standards.
Ability to regularly lift up to 50 lbs.
Top Secret/SCI clearance; SAP Information eligibility and consent to a counterintelligence polygraph.

Nice To Haves

SAP experience.

Responsibilities

Oversee the development, implementation, and evaluation of information-system security program policy, emphasizing integration of existing SAP network infrastructures.
Develop and oversee operational information-systems security implementation policy and network-security guidelines based on RMF, with emphasis on the JSIG authorization process.
Advise customers on RMF assessment and authorization issues.
Perform risk assessments and make recommendations to DoD agency customers.
Advise government program managers on security-testing methodologies and processes.
Evaluate authorization documentation and provide written authorization recommendations to government program managers.
Develop and maintain a formal Information Systems Security Program.
Ensure IAOs, network administrators, and other cybersecurity personnel receive the technical and security training needed to perform their duties.
Develop, review, and endorse system-assessment documentation and recommend action by the AO or DAO.
Ensure approved procedures are in place to clear, sanitize, and destroy hardware and media.
Develop and execute security-assessment plans, including verification that required protection-level features and assurances are functioning.
Maintain an applicable repository for system-authorization documentation and modifications.
Institute and implement a Configuration Control Board (CCB) charter.
Develop policies and procedures for responding to security incidents, including investigating and reporting security violations and incidents.
Ensure appropriate protection or corrective measures are taken when an incident or vulnerability is discovered within a system.
Ensure data ownership and responsibilities are established for each authorization boundary, including accountability, access rights, and special-handling requirements.
Ensure development and implementation of an information-security education, training, and awareness program; attend, monitor, and present local cybersecurity training.
Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
Assess changes in systems, their environments, and operational needs that could affect authorization.
Ensure valid authorization determinations are in place for all authorization boundaries under the ISSM's purview.
Review AIS assessment plans.
Coordinate with the PSO or cognizant security official on approval of external information systems, such as guest systems and interconnected systems belonging to another organization.
Conduct periodic assessments of the security posture of authorization boundaries.
Ensure configuration management for security-relevant software, hardware, and firmware changes, and ensure changes are properly documented.
Ensure periodic testing evaluates information-system security posture using intrusion, attack-detection, and monitoring tools, sharing responsibility with ISSOs.
Ensure system recovery and reconstitution processes are developed and monitored so authorization boundaries can be recovered according to their availability-level determination.
Ensure authorization documentation is current and accessible to properly authorized individuals.
Ensure system-security requirements are addressed during all phases of the system life cycle.
Develop Assured File Transfers (AFT) in accordance with the JSIG.
Perform ISSO duties when an ISSO is not present or available.