DoW Information Systems Security Manager - Cloud (On-site)

Tetrad Digital Integrity LLC•Arlington, VA

19d•$165,000 - $215,000•Onsite

About The Position

Tetrad Digital Integrity (TDI) is seeking a hands-on Information Systems Security Manager to support Department of War cloud enterprise information systems at Impact Level 7 (IL7). This on-site role in Northern Virginia supports mission-critical Department of War programs and involves managing workloads in modern cloud environments, leading Authorization to Operate (ATO) efforts, and translating RMF, NIST SP 800-53, and Cloud Security Requirements Guide requirements into actionable security deliverables. An active Top Secret clearance is required. Minimal travel is required. The role leads and supports Risk Management Framework (RMF) activities throughout their lifecycle, advises on cloud security policy and controls, reviews cloud and containerized architectures, and assesses security risks for generative AI and AI/ML workloads. It develops and maintains RMF documentation, conducts threat modeling and risk analysis, integrates security into the SDLC with technical teams, leads security control assessments, coordinates with third-party assessors, and monitors compliance through continuous monitoring processes.

Requirements

Active Top Secret security clearance.
Advanced proficiency for Information System Security Manager IAW DoD 8140.
Bachelor’s degree in Cybersecurity, Computer Science, or Information Technology.
At least 8 years of cybersecurity experience, including demonstrated experience supporting RMF activities for DoW systems.
Experience leading end-to-end Assessment and Authorization processes in classified DoW environments.
Hands-on experience with at least one cloud platform: AWS, Microsoft Azure, or Google Cloud Platform (GCP), including IAM, VPC/networking, Kubernetes, and cloud security services.
Knowledge of containerized environments such as Docker and Kubernetes, and container security best practices.
Familiarity with generative AI technologies, including LLMs and AI/ML security considerations.
Deep understanding of NIST SP 800-53, DoD RMF, FedRAMP, and other relevant cybersecurity frameworks.
Experience writing and maintaining RMF artifacts such as SSPs, POA&Ms, and SARs.
Strong communication skills and ability to collaborate with technical and non-technical stakeholders.
Experience with security risk assessments in DoW environments.
Must be a US citizen or lawful permanent resident of the United States.

Nice To Haves

Advanced cloud security certifications, such as Google Professional Cloud Security Engineer, Cloud Certified Security Professional, or an Azure equivalent.
Experience integrating DevSecOps pipelines with RMF compliance processes.
Familiarity with RMF documentation and control-testing automation tools such as Xacta, eMASS, or OpenRMF.

Responsibilities

Lead and support RMF activities through categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
Provide guidance on DoW cloud security policies, NIST SP 800-53 controls, CNSS policies, Cloud Computing SRG, and AI-specific guidance.
Conduct security architecture reviews and security engineering analysis for cloud-native and containerized workloads.
Evaluate security controls for Kubernetes, Docker, and container orchestration platforms.
Assess security risks related to generative AI components, including LLMs and AI/ML workloads.
Develop and maintain SSPs, SARs, POA&Ms, and related RMF documentation.
Perform threat modeling, vulnerability assessments, and risk analysis for cloud environments and AI technologies.
Work with system architects, developers, and DevSecOps teams to integrate security throughout the SDLC.
Lead the compliance team through security control assessments and coordinate with third-party assessors.
Monitor, track, and report security compliance posture through Continuous Monitoring processes.
Undertake minimal travel as required.