Information Systems Security Manager (ISSM) III

General Dynamics Information Technology•Colorado Springs, CO

16d•Onsite

About The Position

The Information Systems Security Manager (ISSM) serves as the principal advisor on security matters for information systems under their purview and provides day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities. The role leads and supports the organization's Cyber Security Program, advises government customers and program managers on Risk Management Framework (RMF) assessment and authorization, and develops security policies, assessments, and recommendations in accordance with applicable DoD requirements and the Joint Special Access Program Implementation Guide (JSIG). The ISSM oversees authorization documentation, security assessments, configuration management, incident response, training, self-inspections, and security posture reviews across authorization boundaries. The position also provides leadership, mentoring, and quality assurance for Cyber Security and Information Technology team members. This is an onsite role in Colorado Springs, Colorado, with 40 scheduled hours per week and 10–25% travel required. The role requires current TS/SCI clearance, U.S. citizenship, and the ability to obtain TS/SCI with CI polygraph.

Requirements

10 or more years of related experience.
At least 2 years of SAP experience.
Prior performance in a role such as ISSO or ISSM.
Master's degree or equivalent experience (6 years).
IAT Level III or IAM Level III certification within 6 months of hire.
Current TS/SCI clearance; must be willing to obtain TS/SCI with CI polygraph.
U.S. citizenship required.
Expert knowledge of DoD, national, and applicable service and agency security policies, manuals, and standards.
Ability to regularly lift up to 50 pounds.

Responsibilities

Lead, cultivate, and maintain productive relationships with DoD agency managers, data stewards, and senior leadership to support a positive cybersecurity profile.
Participate in strategic planning and implementation of the Cyber Security Program.
Provide expert input to cybersecurity policies based on the RMF, emphasizing the JSIG authorization process.
Advise customers on RMF assessment and authorization issues and advise government program managers on security testing methodologies and processes.
Develop and implement security assessment plans, perform risk assessments, and make recommendations to DoD agency customers.
Evaluate authorization documentation and provide written authorization recommendations to government program managers.
Develop and maintain a formal Information Systems Security Program.
Ensure information assurance officers, network administrators, and other cybersecurity personnel receive necessary technical and security training.
Develop, review, and endorse system assessment documentation and recommend action by the Authorizing Official (AO) or Designated Approving Authority (DAO).
Ensure approved procedures are in place to clear, sanitize, and destroy hardware and media.
Develop and execute security assessment plans, including verifying that required protection-level features and assurances function properly.
Establish and implement a Configuration Control Board (CCB) charter.
Maintain a repository for system authorization documentation and modifications.
Develop policies and procedures for responding to security incidents, including investigating and reporting security violations and incidents.
Ensure appropriate protection or corrective measures are taken when system incidents or vulnerabilities are discovered.
Ensure data ownership and responsibilities are established for each authorization boundary, including accountability, access rights, and special handling requirements.
Ensure development and implementation of an information security education, training, and awareness program; attend, monitor, and present local cybersecurity training.
Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
Assess system, environment, and operational changes that could affect authorization.
Ensure authorization is completed and a valid authorization determination exists for all authorization boundaries under the role's purview.
Review AIS assessment plans and coordinate approval of external information systems with the PSO or cognizant security official.
Conduct periodic assessments of the security posture of authorization boundaries.
Ensure security-relevant software, hardware, and firmware changes are managed through configuration management and properly documented.
Ensure periodic security testing uses intrusion, attack-detection, and monitoring tools, in shared responsibility with ISSOs.
Ensure system recovery and reconstitution processes are developed and monitored so authorization boundaries can be recovered according to their availability-level determination.
Ensure authorization documentation is current and accessible to properly authorized individuals.
Ensure system security requirements are addressed throughout all phases of the system life cycle.
Establish and develop an organizational self-inspection program and periodically review system security to accommodate policy or technology changes.
Coordinate technical security issues outside the role's expertise or responsibility with the ISSE.
Provide expert research and analysis supporting expanded programs and areas of responsibility in cybersecurity and information technology.
Develop Assured File Transfers (AFT) in accordance with the JSIG.
Provide leadership, mentoring, and quality assurance for Cyber Security and Information Technology team members.