ISSM

Location: Hill AFB, UT

Department: 56219060 - AFS Cyber Strategy Risk and Architecture

We are seeking an experienced Information System Security Manager (ISSM) leader to support secure cloud systems and programs. The ISSM will assume responsibility for ensuring compliance, monitoring cybersecurity posture, supporting and driving RMF accreditation, and guiding the Information System Security Officers (ISSO) in the protection of classified systems. This position requires hands-on technical expertise, thorough familiarity with risk management processes, leadership of ISSO peers, and the ability to collaborate across development, operations, and security teams. Additionally, position will also require heavy coordination with other ISSMs and government POCs.

Responsibilities:

• Lead high-performing team (5 to 10 individuals) and drive complete accountability/ownership
• Develop, sustain, and maintain Rev 5 RMF documentation packages (SSP, SAP, SAR, POA&M, ConMon, etc.)
• Lead development and sustainment of Authorization to Operate (ATO), Interim Authorization to Test (IATT), Incident Response Plan (IRP), and Body of Evidence (BoE)
• Maintain the operational security posture consistent with the security authorization package and ATO requirements
• Collaborate with Security Engineers, DevOps, and IT operations teams during the system design, integration, and development phases to evaluate risk and ensure compliance, including Zero Trust Architecture (ZTA) requirements
• Implement cloud-native security solutions such as encryption, IAM, network segmentation
• Develop and maintain network diagrams (PPSM, Dataflow, etc.) utilizing MBSE
• Engage with Change Control Board (CCB)
• Collaborate heavily with other ISSMs and AO/SCA teams
• Lead and train the following ISSO workflows:
  • Perform continuous monitoring, vulnerability assessment, and risk analysis, validating remediation actions and documenting POA&M updates
  • Verify user clearance, need-to-know, and security responsibilities prior to system access
  • Ensure audit records are captured, reviewed regularly, and anomalies documented
  • Conduct regular system security reviews to ensure compliance with security authorization and STIG/CIS benchmarks and baselines
  • Coordinate hardware/software/firmware changes with ISSM and AO/DAO, notifying stakeholders of security-relevant changes
  • Participate in incident handling, reporting security incidents to ISSMs and AO/DAO teams, and tracking recovery actions to ensure controls are restored correctly
  • Ensure compliance with STIGs, utilizing SCAP Compliance Checker, Evaluate-STIG, and other DoD cyber assessment tools 

What You’ll Need:

• DoD 8140/8570 IAM Level III certification, such as CISSP or CISM 
• At least three (3) years of experience in an ISSM or equivalent security role
• Experience leading small to medium-sized teams and driving accountability/ownership
• Experience performing risk analysis, vulnerability assessments, and security audits
• Strong technical writing skills (security plans, reports, technical writeups) to support documentation responsibilities

Bonus Points if you have:

• Eight (8) years of prior cybersecurity experience
• Experience obtaining and maintaining Certificate to Field (CtF) packages
• Experience providing and maintaining cybersecurity educational training and/or tabletop exercises
• AWS or Azure technical certifications
• Bachelor's degree in Computer Science, Information Assurance, Cybersecurity, or related field
• Experience with Microsoft Defender or similar XDR/EDR tools
• Experience with security incident response teams (NOC/SOC)
• Familiarity with container security (Docker/Kubernetes/ECS/EKS/AKS)

Security Clearance:

• Must have an active TS/SCI level clearance