Information Systems Security Manager

Firefly Aerospace•Cedar Park, TX

2d•Onsite

About The Position

As the Information Systems Security Manager at Firefly Aerospace, you will serve as the primary authority for ensuring mission-critical space systems and enterprise information systems achieve and maintain authorization to operate in compliance with national security requirements. You will own the Risk Management Framework (RMF) accreditation lifecycle per NIST SP 800-37 Rev. 2, implementing CNSSP-12 and CNSSI 53 requirements across space vehicle platforms, ground systems, and supporting infrastructure. You will serve as the primary liaison between system owners, engineering teams, and Government Authorizing Officials (AOs), translating security policy into system requirements, managing security authorization packages, and ensuring continuous monitoring of security controls. You will report directly to the Director of Cybersecurity and work closely with systems engineering, DevOps, and mission operations teams. The position is based at Firefly’s corporate headquarters in Cedar Park, Texas.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related technical discipline.
At least 4 years of direct experience as an ISSM, Security Control Assessor, or in cybersecurity compliance roles within aerospace, defense, intelligence, or DoD contracting environments.
Proven track record managing RMF authorization processes per NIST SP 800-37 Rev. 2 and achieving ATOs for complex technical systems.
In-depth knowledge of NIST SP 800-53, NIST SP 800-171, and FISMA compliance frameworks.
Hands-on experience with DoD security tools including eMASS, ACAS, and HBSS.
Strong understanding of DISA STIGs and DoD Security Technical Implementation Guides.
Experience developing System Security Plans, POA&Ms, and Security Assessment Reports.
Strong written and verbal communication skills, with the ability to translate complex security requirements for technical and executive audiences.
U.S. citizenship required due to ITAR and security clearance requirements.

Nice To Haves

Expertise implementing CNSSP-12 and CNSSI 53 requirements for national security space systems or satellite programs.
Active Secret or Top Secret security clearance, or ability to obtain and maintain clearance.
Direct experience serving as ISSM for operational space systems, satellite ground stations, or telemetry, tracking, and commanding systems.
Knowledge of satellite operations security requirements, including command authentication and telemetry encryption.
CISSP or similar certification, such as CISSP-ISSAP, CISSP-ISSEP, CAP, or Security+.
Experience with CMMC Level 2 or Level 3 assessment and implementation.
Familiarity with requirements management tools such as Jama Connect and IBM DOORS.
Knowledge of NIST SP 800-160 and secure development lifecycle practices.

Responsibilities

Serve as subject matter expert for CNSSP-12 and CNSSI 53 requirements, translating policy mandates into system security requirements and control baselines for space vehicles, ground stations, and mission support systems.
Lead security categorization activities per CNSSI 53, determining Impact Levels and establishing control overlays for national security systems.
Develop and maintain system security architecture documentation, including data flow diagrams, security boundary definitions, and control inheritance mappings.
Coordinate with system owners and engineering teams to identify security control implementation requirements and validate technical solutions against policy mandates.
Conduct security impact assessments, threat modeling, and risk assessments for proposed architectures, system changes, and configuration updates.
Review and approve technical security requirements in system specifications, interface control documents, and engineering design documentation.
Manage end-to-end RMF processes per NIST SP 800-37 Rev. 2 for multiple concurrent systems to achieve and maintain Authorities to Operate.
Develop, maintain, and update System Security Plans and Plans of Action and Milestones, and coordinate Security Assessment Reports.
Coordinate independent security control assessments with Security Control Assessors or third-party assessment organizations.
Prepare and deliver authorization packages to Authorizing Officials, including executive summaries, risk determinations, and authorization recommendations.
Present compliance briefings to senior management, government customers, and Authorizing Officials on security posture, risk status, and authorization timelines.
Establish and operate continuous monitoring programs per NIST SP 800-137, defining security metrics, collection mechanisms, and reporting cadences.
Validate system configurations against STIGs, DISA baselines, and DoD security configuration requirements.
Review vulnerability scans, penetration test findings, and security assessment outputs to identify control weaknesses and drive remediation.
Maintain security control traceability matrices mapping policy requirements to implemented controls and assessment evidence.
Lead corporate information security compliance initiatives for NIST SP 800-171, NIST SP 800-53, CMMC, and Space Policy Directive 5.
Support CMMC Level 2+ compliance, including practice implementation validation, artifact development, and assessment preparation.
Develop and maintain security policies, procedures, and standards that implement regulatory requirements.
Support DCSA assessments, customer security audits, and government inspections.
Track regulatory changes and assess their impacts on existing authorizations and compliance programs.
Participate in systems engineering reviews, design reviews, and change control boards to integrate security requirements early in development.
Validate traceability of security requirements from policy sources through system specifications to implemented controls and test procedures.
Support incident response by providing authorization boundary information, security control details, and impact assessments.
Interface with mission partners and external system interconnections to establish appropriate security agreements and MOUs.