Information Systems Security Manager

JANUS Research Group•Lexington, MA

3d•Hybrid

About The Position

The Information Systems Security Manager (ISSM) owns the security posture of JANUS corporate and controlled unclassified information (CUI) systems. The role maintains compliance with RMF, NIST SP 800-53, NIST SP 800-171, and CMMC Level 2, combining cybersecurity compliance oversight with hands-on system security and user training coordination. The ISSM works with DCSA, the Facility Security Officer (FSO), external MSP and MSSP providers, service providers, developers, and organizational leadership to keep systems secure and compliant. The position covers security and compliance across Microsoft 365, AWS, Windows, Linux, and Active Directory. It includes maintaining security documentation and evidence; preparing for assessments and audits; evaluating cloud, identity, endpoint, and operating-system security; supporting access and configuration management; and coordinating cybersecurity training. The role also owns the secure development program, including security scanning in CI/CD pipelines and working with developers to triage findings. The role is hybrid. Candidates must have an active Secret clearance. The target salary range is $150,000–$170,000; the displayed estimate represents a typical range based on experience and other factors. JANUS offers training and development opportunities and a comprehensive benefits package with health and welfare plans, financial products, a referral bonus program, and other employee awards.

Requirements

Active Secret clearance is required before applying, as stated in the posting.
U.S. citizenship and the ability to obtain or maintain a DoD Security Clearance.
At least 3 years of experience in IT systems, cybersecurity, or compliance support.
Knowledge of NIST SP 800-171, CMMC Level 2, and RMF standards.
Prior interaction with DCSA and knowledge of FSO/ISSM support requirements.
Microsoft 365 administration experience, including Entra ID, Teams, SharePoint, and Exchange.
Security+ or equivalent IAM Level I certification per DoD 8570.
Excellent communication, documentation, and organizational skills.

Nice To Haves

IAM Level II certification, such as CISSP, CISM, or CCNA Security.
Experience supporting DoD contractors or working in a cleared facility environment.
Experience with VMware vSphere, Hyper-V, and KVM/QEMU virtualization technologies.
Experience with containerized compute solutions such as Docker, Podman, and Kubernetes.
Familiarity with Microsoft Intune, Defender, and compliance features.
Experience developing or managing cybersecurity training programs.
Experience supporting developers using Python and C for development, and Terraform and Ansible for deployment.

Responsibilities

Maintain and update cybersecurity documentation, including SSPs, POA&Ms, policies, procedures, and user access records.
Implement and monitor security controls for NIST SP 800-171, NIST SP 800-53, and CMMC Level 2.
Conduct continuous monitoring, collect evidence, and report risk to leadership.
Monitor and analyze Microsoft 365, including GCC High services such as Exchange Online, Teams, SharePoint, and Entra ID.
Review Conditional Access, MFA, privileged roles, and findings from Defender, Purview, and Intune.
Lead preparation for CMMC assessments, DCSA reviews, and audits; work with DCSA, the FSO, service providers, and leadership.
Contribute to security audits, assessments, and continuous monitoring processes.
Coordinate and deliver end-user cybersecurity and IT training, including phishing awareness and acceptable use.
Support onboarding and offboarding and manage system access.
Assist with patch management, system hardening, and endpoint configurations.
Own the secure development program; run SAST, DAST, and dependency scanning tools in CI/CD pipelines and triage findings with developers.
Assess AWS commercial and GovCloud security, including IAM, Security Hub, GuardDuty, CloudTrail, and AWS Config.
Confirm cloud services meet FedRAMP Moderate or equivalent before they hold CUI.
Assess Windows and Active Directory security, including STIG and CIS baselines, Group Policy, privileged groups, tiered administration, service accounts, LAPS, BitLocker, and application control.
Monitor for identity attacks.
Assess Linux security, including STIG and CIS hardening, FIPS, LUKS, application and privilege access control, and auditd logging.
Run and review SCAP scans and remediate findings when necessary.