> Markdown version of [/jobs/ext/3727264-information-systems-security-manager](https://www.wearedevelopers.com/jobs/ext/3727264-information-systems-security-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Systems Security Manager - **Company:** Cape Henry Associates, Inc. - **Location:** Lexington, MA, United States - **Experience:** Experienced - **Salary:** $150,000.0 - $170,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Active Directory, Amazon Web Services, BitLocker Drive Encryption, Burp Suite, Cyber Security, Federal Information Processing Standards (FIPS), Hyper-V, Identity and Access Management, Python (Programming Language), Kernel-Based Virtual Machine, Linux Security Modules, Quick EMUlator (QEMU), Red Hat Enterprise Linux, Cloud Services, Ansible, Anti-Phishing, Security Content Automation Protocol, Microsoft SharePoint, SonarQube, Virtualization Technology, VMware VSphere, Data Logging, Janus, Sonatype, Microsoft InTune, Kubernetes, Information Technology, Tenable Nessus, Patch Management, Opsworks, Terraform, Docker, Static Application Security Testing, Dynamic Application Security Testing - **Published:** October 14, 2026 - **Apply:** http://cape-henry.hrmdirect.com/employment/job-opening.php?req=3840566&req_loc=1511613&& ## About the Role * U.S. Citizenship and ability to obtain or maintain a DoD Security Clearance * 3+ years of experience in IT systems, cybersecurity, or compliance support * Knowledge of NIST SP 800-171, CMMC Level 2, and RMF standards * Prior interaction with DCSA and knowledge of FSO/ISSM support requirements * Microsoft 365 administration experience (Entra ID, Teams, SharePoint, Exchange) * Security+ or equivalent IAM Level I certification (per DoD 8570) * Excellent communication, documentation, and organizational skills Preferred Qualifications * IAM Level II Certification (CISSP, CISM, CCNA Sec, etc.) * Experience supporting DoD contractors or working in a cleared facility environment * Experience with virtualization technologies like VMWare vSphere, Hyper-V, and KVM/QEMU * Experience with containerized compute solutions like Docker, Podman, and Kubernetes * Familiarity with Microsoft Intune, Defender, and compliance features * Experience developing or managing cybersecurity training programs * Experience supporting developers using Python and C for development, and Terraform and Ansible for deployment ## Description The ISSM owns the security posture of JANUS corporate and CUI systems. You keep us compliant with RMF, NIST SP 800-53, NIST SP 800-171, and CMMC Level 2. You also bring hands-on technical depth across Microsoft 365, AWS, Windows, Linux, and Active Directory. This is a hybrid role that combines cybersecurity compliance oversight with system security and user training coordination. The Cybersecurity Compliance Administrator will work closely with DCSA, the Facility Security Officer (FSO), external MSP, MSSP, service providers, and organizational leadership to ensure corporate systems remain secure and compliant., * Maintain and update cybersecurity documentation, including SSPs, POA&Ms, policies, procedures, and user access records. * Implement and monitor security controls for NIST SP 800-171, NIST SP 800-53, and CMMC Level 2. Run continuous monitoring, collect evidence, and report risk to leadership. * Monitor and analyze Microsoft 365, including GCC High: Exchange Online, Teams, SharePoint, and Entra ID. Review Conditional Access, MFA, privileged roles, and Defender, Purview, and Intune findings. * Lead preparation for CMMC assessments, DCSA reviews, and audits. Work with DCSA, the FSO, service providers, and leadership. * Contribute to security audits, assessments, and continuous monitoring processes. * Coordinate and deliver end-user cybersecurity and IT training (e.g., phishing awareness, acceptable use). * Support onboarding/offboarding and system access management. * Assist with patch management, system hardening, and endpoint configurations. * Own the secure development program. Run SAST, DAST, and dependency scanning tools (such as Snyk, SonarQube, OWASP ZAP, or Burp Suite) in CI/CD pipelines, and triage findings with developers. * Assess AWS security (commercial and GovCloud): IAM, Security Hub, GuardDuty, CloudTrail, and AWS Config. Confirm that cloud services meet FedRAMP Moderate (or equivalent) before they hold CUI. * Assess Windows and Active Directory security: STIG and CIS baselines, Group Policy, privileged groups, tiered administration, service accounts, LAPS, BitLocker, and application control. Monitor for identity attacks. * Assess Linux security (RHEL and similar): STIG and CIS hardening, such as FIPS, LUKS, application and privilege access control, and logging (auditd). Run and review SCAP scans and remediating when necessary.