Information Systems Security Manager (ISSM) III

Location: Fort Walton Beach, FL

US Citizenship Required

About the Role

The Information System Security Manager (ISSM) serves as a principal advisor on all matters involving the security of information systems under their purview. The position provides “day-to-day” support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities.

Responsibilities

• Lead, cultivate, and maintain productive working relationships with DoD agencies, managers, data stewards, and senior leadership to foster a positive cybersecurity profile.
• Participate in the strategic planning and implementation of the Cyber Security Program.
• Provide expert input to the formulation of cybersecurity policies based on the Risk Management Framework (RMF), with emphasis on the Joint Special Access Program Implementation Guide (JSIG) authorization process.
• Advise customers on RMF assessment and authorization issues.
• Develop and implement a security assessment plan.
• Perform risk assessments and make recommendations to DoD agency customers.
• Advise government program managers on security testing methodologies and processes.
• Evaluate authorization documentation and provide written recommendations for authorization to government program managers.
• Develop and maintain a formal Information Systems Security Program.
• Ensure all IAOs, network administrators, and other cybersecurity personnel receive necessary technical and security training.
• Develop, review, endorse, and recommend action on system assessment documentation for the Authorizing Official (AO) or Designated Authorizing Official (DAO).
• Ensure approved procedures are in place for clearing, sanitizing, and destroying hardware and media.
• Develop and execute security assessment plans, verifying required features and assurances for each protection level.
• Institute and implement a Configuration Control Board (CCB) charter.
• Maintain a repository for all system authorization documentation and modifications.
• Develop policies and procedures for responding to security incidents, including investigating and reporting violations.
• Ensure proper protection or corrective measures are taken when incidents or vulnerabilities are discovered.
• Establish data ownership and responsibilities for each authorization boundary, including accountability, access rights, and special handling requirements.
• Ensure development and implementation of an information security education, training, and awareness program.
• Evaluate threats and vulnerabilities to determine if additional safeguards are needed.
• Assess changes in the system, its environment, and operational needs that could affect authorization.
• Ensure authorization is accomplished with a valid determination for all boundaries under purview.
• Review AIS assessment plans.
• Coordinate with PSO or cognizant security officials on approval of external information systems (e.g., guest systems, interconnected systems).
• Conduct periodic assessments of the security posture of authorization boundaries.
• Ensure configuration management for security-relevant changes to software, hardware, and firmware, and that they are properly documented.
• Ensure periodic testing is conducted to evaluate system security posture using intrusion/attack detection and monitoring tools (shared responsibility with ISSOs).
• Ensure system recovery and reconstitution processes are developed and monitored.
• Ensure all authorization documentation is current and accessible to authorized individuals.
• Ensure system security requirements are addressed during all phases of the system life cycle.
• Establish and develop a self-inspection program within the organization.
• Periodically review system security to accommodate changes to policy or technology.
• Coordinate technical security issues outside of area of expertise with the Information System Security Engineer (ISSE).
• Provide expert research and analysis to support expanding programs and responsibilities in cybersecurity and IT activities.
• Develop Assured File Transfers (AFT) in accordance with the JSIG.
• Provide leadership, mentoring, and quality assurance for Cyber Security and Information Technology team members.
• Demonstrate expert knowledge of DoD, National, and applicable service and agency security policies, manuals, and standards.

Requirements

• 10+ years of related experience.
• 2+ years of Special Access Program (SAP) experience.
• Prior performance in roles such as ISSO or ISSM.
• Master’s degree or Bachelor’s degree in a related field + 2 years’ experience or Associate’s degree in a related area + 4 years’ experience or equivalent experience (6 years).
• IAT Level III or IAM Level III certification.
• Current Top-Secret Clearance with SCI eligibility.
• Eligibility for access to Special Access Program Information.

Skills

• Information Security
• Information Security Management
• Information System Security

Pay

The likely salary range for this position is $129,795 - $175,605. Salary will be set based on experience, geographic location, and possibly contractual requirements.

Schedule

• Scheduled Weekly Hours: 40
• Travel Required: 10-25%
• Telecommuting Options: Onsite

Benefits

• Medical plan options, some with Health Savings Accounts.
• Dental and vision plan options.
• 401(k) plan with pre- and post-tax contribution options and company match.
• Paid time off, including vacation, sick, personal time, holidays, parental leave, military leave, bereavement, and jury duty leave.
• Short- and long-term disability benefits.
• Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance.