> Markdown version of [/jobs/ext/2032871-information-system-security-manager-issm](https://www.wearedevelopers.com/jobs/ext/2032871-information-system-security-manager-issm). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information System Security Manager (ISSM) - **Company:** RTX - **Location:** Anaheim, CA, United States - **Experience:** Expert - **Salary:** $95,500.0 - $181,700.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Cyber Security, Linux, Identity and Access Management, Information Security Management, Information Systems Security Engineering Professional, Log Analysis, Zero Trust Network Access, SAP (Applications), Security Content Automation Protocol, Security Information and Event Management, Cisco Discovery Protocol, Information Technology, Patch Management, Nessus, National Industrial Security Program Operating Manual (NISPOM), Splunk, Devsecops, Plan of Action and Milestones - **Published:** August 12, 2026 - **Apply:** https://globalhr.wd5.myworkdayjobs.com/REC_RTX_Ext_Gateway/job/US-CA-ANAHEIM-406--160-N-Riverview-Dr--BLDG-406-Ste-150/Information-System-Security-Manager--ISSM-_01864922 ## About the Role Active and transferable U.S. government issued security clearance is required prior to start date. U.S. citizenship is required, as only U.S. citizens are eligible for a security clearance, * Typically requires a degree in Science, Technology, Engineering or Mathematics (STEM), information technology and a minimum of 5 years of prior relevant experience. * Typically requires 5 years experience in DoD/IC Cybersecurity as ISSM or IAM-III equivalent (CISSP, CISM, GSLC). * Proven delivery of ATO for SAP or SCI systems; prior Enterprise ISSM experience. Hands-on with SCAP, STIG Viewer, DISA SRGs, and SIEM/Vulnerability Tools, such as SPLUNK, NESSUS etc. * Experience executing DISA STIG/SRG hardening across Linux and Windows. * Active and transferable Top Secret SCI (TS/SCI) U.S. government issued security clearance is required prior to start date with the ability to obtain a polygraph after start. * U.S. citizenship is required, as only U.S. citizens are eligible for a security clearance. Qualifications We Prefer * Masters in Cybersecurity, Computer Science, or related engineering field. CISSP-ISSEP / ISSMP or PMP. * Hands-on with SCAP, STIG Viewer, DISA SRGs, and SIEM/Vulnerability Tools, such as SPLUNK, NESSUS etc. * Proven leadership of multi-disciplinary teams and successful ATO delivery for SAP or SCI systems. * Expert knowledge of NISPOM (32 CFR 117), JSIG, RMF (NIST 800-37/-53), ICD-503, and DAAPM, oversight/execution of A&A processes. * Experience with DevSecOps pipelines, Zero Trust architecture, and Identity Access Management. * Hands-on with ACAS, SCAP, STIG Viewer, DISA SRGs, and SIEM/Vulnerability Tools SPLUNK, NESSUS etc. ## Description * Lead RMF/JSIG/DAAPM execution - architect secure solutions, prepare authorization packages, brief Security Control Assessments, and drive POA&M closure. * Own continuous monitoring - vulnerability & patch management (ACAS/Nessus, SCAP, STIGs), log analysis (Splunk), account management, media control, incident response, and annual self-inspection. * Shape early program decisions - embed with PMO to define security requirements, supply secure-by-design input, and influence contract CDRLs. * Develop people & process - coach ISSOs/ISSEs, refine SOPs, track metrics, and present status to senior leadership and customers. * Interface with external stakeholders - act as the single voice to DCSA, SAPCO, and other Cognizant Security Agencies for all cybersecurity matters. * Travel: Up to 5% (domestic) ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Discover the open source trio you didn’t expect: .NET and PostgreSQL on Linux](https://www.wearedevelopers.com/videos/2042-discover-the-open-source-trio-you-didn-t-expect-net-and-postgresql-on-linux) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)