Information Systems Security Manager

Intuitive Machines • Palo Alto, CA

4d • $143,000 - $238,000 • Onsite

About The Position

Lanteris Space Systems is seeking an Information Assurance Manager (IAM)/Information Systems Security Manager (ISSM) for its Palo Alto, California office. The role is responsible for a portfolio of classified programs involving Collateral and Sensitive Compartmented Information (SCI). It supports information systems throughout their full life cycle, including scoping systems for new programs; preparing accreditation and certification packages under applicable regulations and standards; maintaining and monitoring operational systems; handling upgrades and feature additions during program execution; and decommissioning and de-certifying systems.

The manager ensures information systems comply with government security policies and applicable requirements, coordinates with government agencies and internal stakeholders, and leads and mentors security professionals. The role also oversees security plans and controls, audits and reviews, training, vulnerability remediation, incident response, media handling, insider threat activities, physical security integration, COMSEC, and applicable TEMPEST/EMSEC requirements.

The position is based in the Palo Alto office. California base pay is $143,000–$238,000 annually. The role is incentive eligible, with the target determined by role and contribution. Eligible employees receive paid time off, health and welfare insurance, and a 401(k).

Requirements

• U.S. citizenship.
• Active TS/SCI clearance and CI Poly.
• Experience as an ISSM/ISSO implementing NISPOM Chapter 8, ICD 503, and/or JSIG information-system requirements in an SAP/SCI environment.
• CISSP and CISM certifications.
• Ability to obtain GSLC certification within six months of hire.
• Bachelor of Science degree, or four additional years of experience in place of a degree.
• Eight years of related IT security experience.
• At least two years of related IT or security experience in a classified SCI environment.
• Hands-on experience with SIEM tools such as Splunk, Elastic, or similar for log analysis and security event correlation.
• Knowledge of information security or information technology standards.
• Experience with the Risk Management Framework (RMF), including participation in assessment and authorization activities.
• Experience conducting security audits and vulnerability assessments in operational classified systems.
• DoDD 8140/8570 certification requirements, such as CompTIA Security+ CE or an equivalent certification.
• Experience coordinating with government assessment teams, including DCSA, NSA, and Program Security Officers.

Nice To Haves

• Experience with RMF workflow management solutions such as XACTA, eMASS, or ServiceNow.
• Familiarity with implementing government directives and policies derived from NIST, CNSSI, ICD, DoD, or other government regulatory compliance standards in a professional industry.
• Experience with information security tools for audit reduction, vulnerability management, change detection, and network monitoring, such as ACAS, Nessus, HBSS, Splunk, RedSeal, Tripwire, DISA SCC, and STIG Viewer.
• Experience developing information-system security plans, policies, and procedures for LAN and WAN information systems.
• Experience with both Windows and Linux operating environments.
• Previous leadership experience.
• Experience managing security incidents and coordinating response activities in classified environments.
• Knowledge of DevSecOps practices and secure software development life cycle in classified systems.
• Experience with insider threat detection tools and procedures.

Responsibilities

• Ensure information systems comply with applicable requirements, potentially across multiple business areas or programs.
• Ensure system security measures comply with government policies; provide configuration management and assess the impact of system modifications and vulnerabilities.
• Apply NIST 800-53 controls, determine controls applicable to each application, and document implementation in the Security Controls Traceability Matrix (SCTM).
• Monitor and resolve Plans of Action and Milestones (POA&Ms) to mitigate vulnerabilities on assigned systems.
• Communicate and coordinate information systems security policy across the organization and work with government agencies to obtain rulings, interpretations, and acceptable deviations.
• Establish, document, implement, and monitor the facility's Information System Security Program and related procedures.
• Prepare and maintain Systems Security Plans (SSPs) that accurately describe system installations and security provisions.
• Verify that SSPs are implemented, security controls are in place and properly tested, and systems function as described.
• Evaluate proposed SSP changes or additions and collaborate with customers to obtain system approvals.
• Conduct ongoing security reviews and tests to verify that information-system security features and operating controls are functional and effective.
• Ensure periodic self-inspections of the facility's Information System Program are conducted as part of the overall facility self-inspection program.
• Ensure development, documentation, and presentation of information-system security education, awareness, and training for facility management, IS personnel, users, and others as appropriate.
• Ensure personnel are trained on prescribed system security restrictions and safeguards before receiving system access.
• Report compliance metrics to the government CSA, Program Management, and Information System Owner.
• Manage, lead, guide, and mentor a team of security professionals.
• Oversee and coordinate insider threat program activities for assigned systems with the Insider Threat Program Manager.
• Ensure proper sanitization, destruction, and accountability of classified media and system components throughout the system life cycle and during decommissioning.
• Coordinate security incident response for assigned systems, including timely reporting to government agencies such as DCSA and NSA and to internal stakeholders.
• Oversee integration of physical security with information-system security requirements in coordination with facility security personnel.
• Manage COMSEC material accountability and cryptographic key management for assigned systems as applicable.
• Ensure compliance with TEMPEST/EMSEC requirements for SCI-level systems as applicable.

Benefits

• Paid time off.
• Health and welfare insurance.
• 401(k) for eligible employees.
• Incentive eligibility, with a target based on contribution, company performance, and/or individual results achieved.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior