Information Systems Security Manager

Team: IT

Location: US

Commitment: Full-time

Workplace Type: remote

Accountabilities

• Own authorization status, security risk posture, privacy compliance, and continuous monitoring activities across an assigned portfolio of information systems.

• Manage multiple concurrent Risk Management Framework (RMF) workflows through eMASS and other Governance, Risk, and Compliance (GRC) platforms, including Xacta, RegScale, and CSAM, from system categorization through continuous monitoring.

• Direct, mentor, and coordinate ISSO teams, assign responsibilities, review authorization packages, and ensure documentation meets applicable security and privacy requirements.

• Lead privacy authorization activities across systems, including the preparation of Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), and System of Records Notice (SORN) determinations.

• Implement and oversee privacy controls aligned with the Privacy Act, OMB Circular A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Revision 5, and CNSSI 1253 privacy overlays.

• Work with Information Systems Security Engineers (ISSEs) and Solutions Architects to identify, map, and document PII and CUI data flows across cloud-native systems and technical architectures.

• Evaluate security and privacy risks across the system portfolio, recommend risk acceptance decisions and Plans of Action and Milestones (POA&Ms), and escalate significant issues to leadership and Authorizing Officials.

• Maintain incident and data breach response procedures aligned with federal and DoD requirements, helping reduce exposure and support effective response.

• Establish standardized privacy templates, training materials, and repeatable authorization workflows to improve consistency and efficiency across the wider team.

• Report on authorization status, privacy compliance, risk posture, and emerging trends to senior leadership and government stakeholders.

• Serve as a primary government-facing security and privacy contact, supporting assessments, authorization decisions, and reciprocity discussions.

Requirements:

• At least 7 years of hands-on experience in DoD cybersecurity, RMF authorization, or information assurance.

• At least 3 years in an ISSM, Lead ISSO, or equivalent leadership role with accountability for multiple ATO packages.

• At least 3 years of direct federal or DoD privacy experience, including preparing PTAs and PIAs, making SORN determinations, and implementing privacy controls.

• Advanced practical experience managing authorization packages in eMASS, along with strong proficiency in at least one additional GRC platform such as Xacta, RegScale, or CSAM.

• Expert knowledge of NIST SP 800-53 (Revisions 4 and 5), NIST SP 800-37 RMF, CNSSI 1253, privacy overlays, and relevant DoD implementation guidance.

• Strong understanding of federal privacy requirements, including the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.

• Demonstrated ability to lead, mentor, and quality-review ISSOs or compliance professionals while managing several authorization initiatives simultaneously.

• Technical familiarity with cloud environments and modern software architectures, including AWS, containers, Kubernetes, and CI/CD pipelines, with the ability to translate cloud-native designs into appropriate security and privacy controls.

• Active U.S. Secret security clearance.

• DoD 8570/8140 IAM Level II baseline certification, such as CISSP, CISM, or CASP+, or the ability to obtain one within 90 days.

• IAPP privacy certification, such as CIPP/G, CIPP/US, CIPM, or CIPT, or the ability to obtain one within 6 months.

• Strong written and verbal communication skills, including the ability to brief Authorizing Officials, privacy officers, and senior executives on security risks, authorization status, and compliance.

• U.S. citizenship is required.

• Location requirement: Candidates must reside in one of the approved hiring hubs: Washington, D.C./Maryland/Virginia or Denver/Colorado Springs, Colorado.

• A proactive, solutions-oriented approach, with strong personal accountability, autonomy, teamwork, and a focus on measurable results.

Benefits:

• Annual base salary of $170,000–$180,000, depending on professional background, technical expertise, seniority, and regional factors.

• Eligibility for equity awards and discretionary performance bonuses.

• 100% employer-paid medical, dental, and vision coverage for employees and their dependents.

• 401(k) plan with a 3% company contribution.

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, and family planning support.

• Equity incentive plan.

• New-hire technology package and home office stipend.

• Annual professional development stipend.

• Flexible paid time off and all federal holidays.

• Generous parental leave.

• Flexible remote work arrangements.

• Employee referral bonus program.