ISSO PROGRAM MANAGER (PgM)

Zermount, Inc•Arlington, VA

49d•Hybrid

About The Position

Zermount, Inc. is seeking an ISSO Program Manager (PgM) to support their client by providing project management and Information Security expertise for the ISSO Team. The role involves securing enterprise information and systems, determining security requirements, planning, designing, implementing, and testing systems and security technologies, developing security standards, policies, and procedures, and mentoring team members. The ISSO Program Manager acts as the senior cybersecurity lead, responsible for managing security compliance, RMF activities, and continuous monitoring for all client enterprise systems, while also providing full lifecycle program management support. This position integrates IT and Information Security subject matter expertise with project management to ensure secure, compliant, and mission-aligned delivery for a federal client. The role involves managing security operations, reporting, deliverables, stakeholder communication, resources, schedules, and technical oversight of cybersecurity governance, risk, and compliance (GRC) activities to meet agency and contract requirements.

Requirements

At least 7 years of experience managing IT Security programs for a minimum of 5000+ users, 10,000+ assets, and numerous tools.
At least 5 years of experience leading teams, minimally, of 10 direct reports.
Experience developing, implementing, and managing project schedules.
Ability to manage multiple projects, work under pressure and tight deadlines, work independently, and work in a team environment.
Ability to effectively communicate both orally (in common English narration) and in writing (to include technical documentation).
Ability to explain and breakdown technical details and solutions to executive management and non-technical parties, explaining the true business impact.
Good understanding of network protocols, design, and operations.
Strong analytical skills and efficient problem solving.
Experienced writing security-related procedures and guidelines.
Experience with NIST Special Publications and guidance.
Excellent report development and presentation skills.
Strong problem-solving and analysis skills, self-motivated, and able to work and communicate in a team environment.
Proficient in Microsoft® Office suite to include Project, and other office automation products.
Minimum of Bachelor's degree in Computer Science, IT, Engineering, or similar fields. Years of experience will be taken into consideration in place of a degree.
Must have a minimum of one (1) IT Security certification at the IAM III Level referenced in the Department of Defense Approved 8570 Baseline list.
Public Trust clearance.
Must be a United States citizen.

Nice To Haves

PMI PMP certification
ITIL certification

Responsibilities

Provide day-to-day management of the ISSO Team, develop project schedules, reports, and briefings in accordance with contract requirements.
Provide primary accountability to ensure task orders receive the appropriate support and resources required to deliver quality results.
Provide strategic direction, vision, leadership, and management to the team(s) assigned to the task order.
Contribute to organizational direction through regular involvement with client leadership and team members.
Maintain productive and effective client relationships with the most senior levels of the client organization.
Manage numerous project schedules simultaneously.
Develop, maintain, and update project management plans, project schedules, and an Integrated Master Schedule (IMS).
Develop, maintain, and update Quality Assurance Surveillance Plans (QASP).
Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations, enterprise, or local policy, assess the level of risk, and develop and recommend appropriate mitigations.
Ensure ISSO team meets contract requirements and client-established KPIs and performance metrics.
Provide risk analysis for vulnerabilities, incidents, and change requests and advise on the impact of new or changing applicable federal policy changes.
Conduct research and present analyses to evaluate and/or determine emerging industry technology trends, government agency best practices, and security issues.
Determine security requirements by evaluating strategies/requirements; research IT security standards; conduct security and vulnerability analyses and risk assessments; review architecture/platform; identify integration issues; prepare cost estimates.
Provide expertise and guidance to OCIO on DevSecOps/secure development, operational systems, and enhancements in support of the client's mission.
Assist business owners, system owners, and system engineers with selecting and implementing controls that maintain a high level of security and protect patron privacy.
Monitor and ensure compliance with standards, policies, and procedures; support IR activities; develop and conduct training programs.
Prepare security reports by collecting, analyzing, and summarizing data and trends.
Enhance company and client's reputation by accepting ownership for accomplishing new and different requests, exploring opportunities to add value to job accomplishments.
Lead ISSOs for assigned systems in accordance with NIST RMF, FISMA, agency policy, directives, Zero Trust, and cybersecurity requirements.
Ensure quality requirements are met for system security documentation development and maintenance, including SSPs, Security Assessment Packages (SAP), SARs, POA&Ms, and continuous monitoring artifacts.
Ensure all systems maintain ongoing authorization by implementing continuous monitoring, monthly artifact updates, vulnerability remediation, log review oversight, and risk tracking.
Collaborate with technical teams to ensure security requirements are incorporated into system design, enhancements, and operational changes.
Support audit readiness, respond to IG/OIG inquiries, and manage external assessment requests.
Provide expert guidance on NIST SP 800-53, 800-37, 800-30, 800-137, 800-61, Zero Trust Architecture (800-207), and CISA Zero Trust Maturity Model.
Manage project risks, issues, dependencies, timelines, and reporting across the lifecycle.
Prepare and deliver weekly, monthly, and quarterly program status reports, dashboards, and executive briefings.