Sr. Information System Security Manager (ISSM)

Authorization and RMF

• Lead all AUTEC systems through the six RMF steps under DoDI 8510.01, from categorization through authorization and continuous monitoring.
• Build, maintain and submit authorization packages in eMASS: System Security Plan, security control traceability, risk assessments, POA&Ms and supporting artifacts.
• Track ATO expiration dates and start reauthorization early enough that no system operates without a valid authorization.
• Coordinate assessments with the Security Control Assessor (SCA) and Navy Qualified Validators, and close findings on schedule.
• Assess the security impact of every proposed system change and serve as a voting member of the Configuration Control Board.

Continuous Monitoring and Vulnerability Management

• Run the continuous monitoring program: scheduled ACAS/Tenable scans, STIG and SRG compliance checks, endpoint security (ESS) reporting and log review.
• Track IAVM notices (IAVAs, IAVBs, TAs) and Navy cyber orders to closure, reporting compliance by the required dates.
• Own the cybersecurity POA&M: accurate milestones, realistic dates and documented mitigations for every open weakness.
• Prepare the site for Command Cyber Readiness/Operational Readiness inspections and other Government audits.

Incident Response and Reporting

• Maintain the site incident response plan and lead the contractor response to cybersecurity incidents and spillages.
• Report incidents to the Government ISSM and Navy cyber defense channels within required timelines.
• Produce monthly cybersecurity status reports and brief program leadership and the Government on risk.

Program People and Policy

• Supervise, task and develop ISSOs and cybersecurity technicians; verify each holds the DoD 8570/8140 qualification their work role requires.
• Manage privileged access: DD Form 2875 (SAAR) processing, privileged user agreements and periodic access reviews.
• Run cybersecurity awareness, removable media, and data-at-rest and data-in-transit controls for the site.
• Write and maintain cybersecurity policies, standard procedures and continuity plans aligned with DoD, DoN and contract requirements.
• Advise engineering and operations on secure design for new range, T&E and network capabilities, including Zero Trust alignment.

Other related duties as assigned.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science or a related field.
• At least 8 years of information assurance or cybersecurity experience, including at least 3 years as an ISSM or ISSO on DoD systems.
• Hands-on experience taking DoD systems through RMF to an ATO, including authoring the SSP, POA&M and other package artifacts.
• CISSP or CISM
• Working proficiency in eMASS.
• Experience applying DISA STIGs and SRGs, and managing vulnerability remediation with ACAS/Tenable.
• Working knowledge of NIST SP 800-37, NIST SP 800-53, CNSSI 1253 and DoDI 8510.01.
• Experience managing IAVM compliance and cybersecurity POA&Ms against Government deadlines.
• Ability to occasionally travel, live and work on-site at AUTEC, Andros Island, a remote location, and to hold a valid U.S. passport and valid drivers license.
• Must be able to obtain and maintain a Secret U.S. Government Clearance. Note: U.S. Citizenship is required to obtain a Secret Clearance.
• Strong written and verbal communication, including briefing risk to Government leadership and auditors.

Preferred Requirements

Clearance and Education

• Master’s degree in Cybersecurity, Information Assurance or a related field.
• Active Secret Clearance.

Certifications

• CISSP-ISSMP or CISSP-ISSEP concentration.
• CompTIA SecurityX (formerly CASP+), CISM or GIAC GSLC.
• PMP or equivalent project management certification.

Navy and DoD Experience

• Experience supporting NAVSEA, NUWC or another Navy warfare center, and working with the Navy AO and Navy Qualified Validators.
• Prior ISSM duty on a Government-owned, contractor-operated (GOCO) site or a remote/OCONUS installation.
• Experience leading a site through a Command Cyber Readiness or Operational Readiness inspection.
• Experience with classified systems, including JSIG, DCSA DAAPM or SAP environments.

Technical Depth

• Experience securing Platform IT, industrial control systems or range instrumentation and test-and-evaluation systems.
• Experience with Splunk or another SIEM, Trellix ESS and Microsoft security tooling.
• Familiarity with DoD Zero Trust strategy and capability roadmaps.
• Experience with cybersecurity supply chain risk management and cloud authorizations (FedRAMP, DoD Cloud SRG).

Leadership

• Experience supervising a cybersecurity team of three or more.
• Experience writing cybersecurity procedures within a corporate business management system.

Compensation Details: $125,000

The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.

Benefits Overview:

Our health and welfare benefits are designed to support you and your priorities. Offerings include:

• Health, dental, and vision insurance
• Paid time off and holidays
• Retirement benefits (including 401(k) matching)
• Educational reimbursement
• Parental leave
• Employee stock purchase plan
• Tax-saving options
• Disability and life insurance
• Pet insurance

Note: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O’Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.