> Markdown version of [/jobs/ext/257986-information-systems-security-manager](https://www.wearedevelopers.com/jobs/ext/257986-information-systems-security-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Systems Security Manager - **Company:** P3S Corporation - **Location:** Ellsworth Air Force Base, SD, United States - **Experience:** Expert - **Salary:** $90,000.0 - $150,000.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Information Systems, Decision Support Systems, Federal Information Processing Standards (FIPS), Firmware, Security Content Automation Protocol, Software Systems, Software Vulnerability Management, Information Technology, Nessus, Vulnerability Analysis - **Published:** May 16, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=ff16f96265a74c4f ## About the Role Do you have experience in Vulnerability scanning?, * Bachelor's degree in cybersecurity, computer science, information systems, engineering, or related field preferred. * 7-10+ years of cybersecurity, RMF, IA, ISSM, ISSO, or DoD system security experience. * 3+ years managing or overseeing ISSOs, RMF packages, ATOs, or cybersecurity compliance programs. * Air Force, DoD FM, ERP, financial system, or enterprise mission system experience strongly preferred. Certifications Recommended minimum: * CISSP, CISM, CGRC/CAP, CASP+/SecurityX, GSLC, or equivalent DoD 8140-aligned senior cybersecurity certification. Preferred: * CISSP-ISSMP, CISM, CGRC, PMP, CCSP, GSLC, or advanced RMF/DoD cybersecurity training. DoD 8140.03 now governs cyberspace workforce qualification, replacing the older 8570 framework for role-based qualification alignment., * Managing ISSOs: 3 years (Preferred) * Managing RMF packages and ATOs: 3 years (Preferred) * Cybersecurity, RMF, IA and DoD systems: 7 years (Preferred) License/Certification: * * CISSP, CISM, CGRC/CAP, CASP+/SecurityX, GSLC (Preferred) ## Description The ISSM will serve as the senior cybersecurity authority for assigned Air Force Financial Management systems and will provide cybersecurity program oversight, RMF governance, ISSO supervision, artifact quality control, ATO decision support, vulnerability/risk management oversight, and stakeholder coordination. The SOW states that the ISSM provides quality control, oversight, and approval for ISSO work products, while supporting FM AO decision packages, risk-informed authorization decisions, eMASS/ITIPS artifacts, vulnerability trends, and leadership briefings. Key Duties The ISSM will: Cybersecurity Program Management * Serve as the primary cybersecurity advisor to the AO/AODR for assigned systems. * Establish, manage, and enforce cybersecurity policies, standards, procedures, and RMF execution practices. * Ensure cybersecurity requirements are integrated across the full system lifecycle. RMF Oversight / ATO Support * Oversee RMF execution for assigned systems. * Ensure proper system categorization under CNSSI 1253 and FIPS 199. * Review and approve SSPs, SAR/RAR, RARS, POA&Ms, control evidence, continuous monitoring plans, and authorization packages. * Prepare or review AO staffing packages for ATO, ATO with Conditions, Denial, or risk acceptance decisions. ISSO Oversight * Appoint, train, mentor, and oversee ISSOs. * Review ISSO-submitted artifacts, self-assessments, evidence, POA&M updates, and security documentation. * Hold ISSOs accountable for system-level day-to-day cybersecurity posture. Security Control / Vulnerability Management * Ensure controls are implemented, assessed, monitored, and operating effectively. * Oversee STIG compliance, IAVA/IAVB/IAVT tracking, vulnerability remediation, and risk-based mitigation planning. * Coordinate with the SCA during assessments. Configuration / Change Management * Enforce secure configuration management across assigned systems. * Approve significant hardware, software, firmware, architecture, or boundary changes. * Ensure security impact analyses are documented before changes are implemented. Incident Response / Reporting * Establish and maintain incident response procedures. * Ensure incidents are identified, reported, contained, remediated, and documented. * Coordinate with Wing Cybersecurity Office, AFCYBER, law enforcement, counterintelligence, and leadership as needed. SCRM / Acquisition Support * Identify and mitigate supply chain risks for hardware/software. * Coordinate with PMs and contracting officials on cybersecurity requirements for acquisitions. Leadership Reporting * Brief FM leadership on risk posture, vulnerability trends, POA&M status, ATO readiness, and remediation progress. * Participate in governance forums, inspections, audits, program reviews, and authorization boards. Required Knowledge / Systems * RMF, DoDI 8510.01, DoDI 8500.01, DoD 8140.03, AFI 17-101, NIST SP 800-53, CNSSI 1253, FIPS 199. * eMASS and ITIPS at reviewer/approver level. * SSP, SAR/RAR, RARS, POA&M, ATO, continuous monitoring, control inheritance, risk acceptance. * DISA STIGs/SRGs, ACAS/Nessus, SCAP, HBSS/ESS, vulnerability management. * Air Force cyber reporting channels, Wing Cybersecurity Office coordination, AFCYBER reporting awareness. * Strong leadership, audit readiness, briefing, technical writing, and cross-functional coordination skills. ## Related Videos - [Playing Pong on a shoulder press machine](https://www.wearedevelopers.com/videos/100140-playing-pong-on-a-shoulder-press-machine) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Agent Smith Gets Hardware: Autonomous IoT Hacking From Debug Port to Cloud API](https://www.wearedevelopers.com/videos/100258-agent-smith-gets-hardware-autonomous-iot-hacking-from-debug-port-to-cloud-api) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)