Information Systems Security Manager (ISSM)

Iron Will Ventures•Crane, IN

About The Position

Iron Will Ventures is seeking an experienced Information Systems Security Manager (ISSM) to support its operations in the Crane, Indiana area. The ISSM will establish, implement, maintain, and continuously improve security practices for classified information systems supporting company programs and customer requirements. The role works with company leadership, program managers, technical personnel, the Facility Security Officer (FSO), Information System Security Officers (ISSOs), customers, and Government security representatives to ensure systems are authorized, configured, operated, maintained, monitored, and protected appropriately. The ISSM serves as a principal technical and administrative authority for classified information systems under the National Industrial Security Program (NISP). The position translates contractual and regulatory requirements into practical technical and operational solutions, supports authorization and compliance activities, develops security documentation, advises technical teams, and engages directly with Government and industry stakeholders. The role requires hands-on participation in documentation, system authorization, compliance, and remediation activities. As required by programs and customer needs, the ISSM may also support information systems located within or supporting Sensitive Compartmented Information Facilities (SCIFs). This may include support for SCI system authorization and operations, SCIF planning and infrastructure changes, inspections, assessments, and associated security documentation.

Requirements

At least 5 years of cybersecurity experience.
At least 3 years of experience with classified systems.
At least 2 years of ISSM or ISSO experience.
Bachelor’s degree or equivalent experience.
Security+ CE or higher, plus any DoD 8140 qualifications when contractually required.
DCSA experience.
NISP eMASS experience.
RMF, SSP, and POA&M experience.
Active Secret clearance.
Demonstrated experience managing or supporting classified information systems in a Department of Defense or Intelligence Community environment.
Working knowledge of the NISPOM, DCSA requirements and processes, and the Risk Management Framework.
Understanding of security controls, vulnerability management, configuration management, incident response, access control, audit requirements, and classified-system operations.
Ability to work effectively with security personnel, engineers, IT professionals, program managers, Government customers, and company leadership.
Comfort working directly with Government security representatives and supporting formal assessments and inspections.
Ability to operate independently and represent the company effectively with customers, partners, and Government stakeholders.

Nice To Haves

CISSP or CISM certification.
NBIS and/or DISS experience.
SCI and SCIF experience.
Top Secret clearance.

Responsibilities

Serve as a principal technical and administrative authority for classified information systems operating under the National Industrial Security Program (NISP).
Ensure classified systems are designed, configured, operated, maintained, and decommissioned in accordance with contractual requirements, the NISPOM, DCSA guidance, RMF requirements, and company security policies.
Develop and maintain System Security Plans (SSPs), authorization packages, POA&Ms, continuous-monitoring artifacts, configuration-management records, incident-response documentation, and related system-security documentation.
Coordinate security authorization activities with the FSO, ISSOs, system owners, program managers, technical personnel, customers, and DCSA representatives.
Lead or support security-control assessments, risk assessments, vulnerability assessments, configuration reviews, remediation activities, and continuous monitoring.
Track findings through closure, validate corrective actions, and communicate material security risks and compliance gaps to appropriate stakeholders.
Monitor cybersecurity threats, vulnerabilities, advisories, and security events, and coordinate patches, mitigations, configuration changes, and compensating controls.
Lead or support cybersecurity incident investigation, containment, recovery, documentation, and reporting.
Advise leadership, engineers, system administrators, program managers, and users on security architecture, system design, technical risk, compliance obligations, and secure operating practices.
Establish and maintain procedures for account management, privileged access, media protection, audit logging, configuration management, vulnerability management, backup and recovery, remote access, inventories, system maintenance, and controlled system disposal.
Ensure users receive appropriate security-awareness, role-based, and system-specific training before receiving system access.
Support proposals and contract execution by reviewing security requirements and recommending staffing, compliance approaches, security architecture, technical solutions, and security deliverables.
Represent Iron Will during customer security reviews, assessments, inspections, and engagements with Government security personnel.
Develop and maintain company policies, procedures, standards, and training materials for classified information systems.
Coordinate with the FSO, SCIF Manager, program management, customer security representatives, and applicable Cognizant Security Authorities on SCIF-related information systems.
Support authorization, configuration, operation, monitoring, maintenance, and decommissioning of systems supporting SCI.
Provide information-systems security input for SCIF planning, construction, renovation, relocation, connectivity, and operational changes.
Ensure proposed system and infrastructure changes undergo appropriate security, configuration-management, and authorization processes.
Support inspections, assessments, customer reviews, and Government engagements involving SCIF-supported systems.
Maintain required security documentation, configuration records, assessment evidence, continuous-monitoring results, and corrective-action plans.