Information Systems Security Manager (ISSM)

Abacus Technology • Bedford, MA

18d • $175,800 - $195,100

About The Position

Abacus Technology is seeking an Information System Security Manager (ISSM) to ensure system and application deliverables meet the required cybersecurity policies and regulations for the Technical Advisory and Assistance Services (TAAS) program at Hanscom AFB. This is a full-time position. The role supports system and application Assessment and Authorization (A&A), including work governed by National, Department of Defense, and Department of the Air Force policies such as the Risk Management Framework (RMF). The ISSM evaluates and manages system security risks, vulnerabilities, changes, testing, monitoring, and compliance throughout the system development lifecycle.

The position also develops, reviews, and maintains security plans and RMF artifacts; records system and security information in applicable databases and the Air Force Information Technology Investment Portfolio Suite (ITIPS); and supports assessments, special projects, and cybersecurity taskers involving government and military organizations. Applicants must be U.S. citizens with a current Top Secret clearance and must meet eligibility requirements for access to classified information.

The projected compensation range is $175,800–$195,100. Final salary may depend on factors including contract wage determination, relevant experience, skills, location, education, certifications, and applicable federal contract labor categories. Abacus Technology offers health and dental insurance, 401(k) and matching, life insurance, short- and long-term disability, paid time off, paid holidays, and professional membership, technical training, certification, and education assistance.

Requirements

• At least 3 years of experience in cybersecurity or information assurance.
• Bachelor’s degree in a related field.
• Hold at least one of the following certifications: Security+, CISSP, CISM, CASP+/SecurityX, CEH, or CySA+.
• Experience with the certification and accreditation process.
• Significant experience in vulnerability scanning and analysis, including automated tools and vulnerability management systems.
• Knowledge of intrusion prevention and network access control tools or systems.
• Understanding of system audit principles and security risk assessment.
• Strong understanding of U.S. Government security policy, including Department of Defense and appropriate civil agency policies such as NIST.
• Ability to perform work ensuring the confidentiality, integrity, and availability of systems, networks, and data through information systems security program planning, analysis, development, implementation, maintenance, and enhancement.
• Knowledge of cryptography and cryptographic key management concepts.
• General experience developing common-user and special-purpose command-and-control/information systems, with increasing responsibility for the scope and magnitude of systems for which solutions have been implemented.
• Solid understanding of network infrastructure and mission assurance.
• Familiarity with federal government and DoD information assurance/security standards, including DIACAP, FISMA, NIST, and OMB.
• Strong communication skills and ability to work with all levels of an organization.
• U.S. citizenship.
• Current Top Secret clearance.
• Must meet eligibility requirements for access to classified information and be subject to a U.S. government security investigation.

Responsibilities

• Support system and application Assessment and Authorization (A&A), assessing and guiding the quality and completeness of required activities, tasks, and artifacts.
• Recommend policies and procedures to protect information systems, networks, and data from unauthorized access and to ensure their reliability and accessibility.
• Conduct risk and vulnerability assessments and inspections of planned and installed information systems; identify vulnerabilities, risks, and protection needs.
• Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
• Evaluate system changes, including Deficiency Reports, Problem Reports, Change Requests/Proposals, and AF Form 1067s; contribute to root cause analysis and solution recommendations; assess security impacts; and document resulting RMF artifact changes in written reports.
• Review modification packages, program and system documents, support agreement updates, and communications and network infrastructure upgrades for cybersecurity configuration management and required technical, managerial, operational, and support requirements.
• Review system test plans and results and, when necessary, observe testing for security control implementation in accordance with cybersecurity policies, guidance, and plans.
• Perform security impact analyses for system changes and prepare assurance, security impact, and risk assessment letters, including applicable exceptions, deviations, or waivers.
• Monitor intelligence and open-source information for system vulnerabilities, assess risk, and recommend Plan of Action and Milestones (POA&M) actions.
• Promote security awareness among management and ensure sound security principles are reflected in organizational visions and goals.
• Conduct systems security monitoring, evaluations, audits, and reviews.
• Recommend systems security contingency plans and disaster recovery procedures.
• Recommend and implement programs to ensure system, network, and data users understand and follow security policies and procedures.
• Participate in network and systems design, including cryptographic systems, to ensure appropriate security policies are implemented.
• Facilitate gathering, analysis, and preservation of evidence used in the prosecution of computer crimes.
• Assess security events, determine their impact, and implement corrective actions.
• Ensure cybersecurity and cryptographic policies, principles, and practices are applied throughout the system development lifecycle.
• Author, monitor, and record system information in applicable databases.
• Prepare and record system, security status, and portfolio management information in ITIPS for FISMA, SISSU, the Clinger-Cohen Act, and other statutory compliance.
• Author, review, certify, and/or maintain security management plans and RMF artifacts, including RMF Implementation Plans, System Security Management Plans, Information Support Plans, Program Protection Plans, Security Risk Analyses, Security Vulnerability and Countermeasure Analyses, Vulnerability Management Plans, Common Control Packages, Security Concepts of Operations, OPSEC Plans, Authority-to-Connect guest system packages, and other system and network security documents.
• Support external teams evaluating system cybersecurity posture, including teams conducting non-regular cyber tests, war games, penetration tests, and studies for organizations such as NSA, DISA, and the Air Force Audit Agency.
• Support development, coordination, and implementation of cybersecurity special projects and taskers, including Defensive Cyber Operations, higher headquarters requests, NOTAMs, Technical Change Orders, and requests involving specified military and government organizations.

Benefits

• Health insurance
• Dental insurance
• 401(k)
• 401(k) matching
• Life insurance
• Short- and long-term disability
• Paid time off
• Paid holidays
• Professional membership, technical training, certification, and education assistance

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level