Program Information System Security Manager

Leidos•Huntsville, AL

1d•$107,900 - $195,050•Onsite

About The Position

Leidos Dynetics is seeking a Program Information System Security Manager (P-ISSM) to join its Information Assurance team in Huntsville, Alabama. The role supports Leidos Defense Systems Sector programs operating on DCSA-authorized classified networks. The P-ISSM reports to the Collateral Information System Security Manager (ISSM), leads a team of Information System Security Officers (ISSOs), and is accountable for authorization, continuous monitoring, and inspection readiness of assigned systems. The position also includes coaching and mentoring IA staff and future leaders. The P-ISSM provides personnel and technical oversight for ISSOs and serves as the primary information assurance contact for program managers, facility security officers, and program personnel. The role leads authorization and ongoing authorization activities, manages security documentation and risk decisions, and oversees configuration management, vulnerability remediation, security assessments, incident response, and preparation for government inspections. Work is performed on-site in Huntsville, with up to 25% local telework allowed. Candidates must hold an active Secret clearance and be eligible to obtain Top Secret clearance after hire.

Requirements

Bachelor's degree and 8 or more years of relevant cybersecurity, information technology, information assurance, or information systems security experience; or a master's degree and 6 or more years of relevant experience. Additional relevant experience may be considered in lieu of a degree, consistent with Leidos job-level requirements.
Active DoD Secret clearance and ability to obtain and maintain a Top Secret clearance.
Current industry certification required by DoD 8140 policy and aligned to the DCWF Information Systems Security Manager work role (such as CISSP, CISM, CAP, CGRC, GSLC, or equivalent), or otherwise meeting DoD 8140 qualification requirements through approved education, training, or experience.
Working knowledge of RMF, System Security Plans, and authorization activities for DCSA- and customer-authorized classified systems.
Working knowledge of NISPOM and the DCSA Assessment and Authorization Guide.
Proficiency with eMASS.
Experience with vulnerability management, compliance, and security monitoring tools.
Ability to develop and maintain detailed cybersecurity documentation and objective evidence supporting system compliance.
Ability to independently manage multiple cybersecurity activities and priorities.
Ability to communicate challenges, risks, and solutions effectively in writing and orally to program and IA leadership, and to influence project and team leaders on solution design and approach.
Proficiency in Microsoft Office and Microsoft collaboration tools.
Relevant experience may include cybersecurity, information assurance, information systems security, system administration, or information technology.
Relevant experience may include RMF compliance, DCSA DAAG, NISPOM, NIST SP 800-53 security control implementation and assessment, or maintenance of authorization packages.
Relevant experience may include continuous monitoring, vulnerability management, security configuration assessment, and audit log analysis.
Relevant experience may include preparation for and support of DCSA assessments, inspections, or other government cybersecurity readiness reviews.
Relevant experience may include leading, mentoring, or supervising cybersecurity or technical staff.
Relevant experience may include project or program management involving technical, cybersecurity, compliance, or information system activities.

Nice To Haves

High proficiency with the DCSA instance of eMASS or equivalent.
Experience preparing for and supporting DCSA On-Site Validations, CORA, SVA, or other government cybersecurity inspections.
Familiarity with DoD classified information systems, including SIPRNet, SDREN, or other classified computing environments.
Experience with Splunk, Trellix, Tenable/ACAS, SCAP Compliance Checker, and STIG Viewer.
Working knowledge of Windows and Linux operating systems, Active Directory, virtualization, and enterprise identity management solutions.
Familiarity with cyber incident response activities, including detection, containment, eradication, recovery, and reporting.
Prior experience managing teams of three or more individuals.

Responsibilities

Manage a team of ISSOs, including employee check-ins, performance plans and reviews, training, professional development, and coaching.
Provide technical oversight and quality review of ISSO assessments, authorization artifacts, and configuration management reviews, delegating authority as appropriate.
Serve as Program ISSM for assigned classified information systems and work with the Collateral ISSM to develop, implement, and maintain security policies, procedures, and documentation compliant with applicable standards.
Lead Authorization to Operate and ongoing authorization activities, including System Security Plans, security control assessments, POA&Ms, and Body of Evidence artifacts maintained in eMASS.
Review and certify authorization packages for submission to the Authorizing Official, and coordinate risk acceptance and POA&M decisions with the Collateral ISSM.
Serve as the primary IA point of contact for Program Managers, Facility Security Officers, and program personnel, providing cybersecurity guidance and influencing system design, processes, and risk decisions.
Develop risk-based solutions to complex technical and compliance issues spanning systems, programs, and technical disciplines.
Lead Configuration Management efforts, chair or participate in the Change Control Board, approve security-relevant changes, and elevate significant changes as required.
Oversee continuous monitoring, vulnerability scanning and remediation tracking, STIG and SCAP compliance, audit log review, security event analysis, and mitigation of findings.
Direct preparation for DCSA Cyber Operational Readiness Assessments, Security Vulnerability Assessments, On-Site Verifications, and other government cybersecurity inspections, and coordinate corrective actions.
Investigate information system security incidents and violations and ensure required reporting and corrective and preventative actions are completed.
Oversee media sanitization, declassification, and hardware release in accordance with security policy and Authorizing Official guidance.
Perform risk and vulnerability assessments and security audits, identify system weaknesses, and provide risk-based remediation strategies.
Evaluate and implement cybersecurity processes, technologies, and tools to improve security, compliance, and operational effectiveness.
Prepare and present status reporting to the Collateral ISSM, including weekly action reports and monthly operations reports.
Develop and deliver information system security training and awareness for users, privileged users, and ISSOs.
Perform ISSO duties as needed.