> Markdown version of [/jobs/ext/4443917-information-systems-security-manager-rmf-and-cmmc](https://www.wearedevelopers.com/jobs/ext/4443917-information-systems-security-manager-rmf-and-cmmc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Systems Security Manager, RMF and CMMC

- **Company:** Whitman, Requardt & Associates, LLP
- **Location:** Baltimore, MD, United States
- **Experience:** Experienced
- **Salary:** $110,000.0 - $165,000.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Cyber Security, Multi-Factor Authentication, Identity and Access Management, SAP (Applications), Software Vulnerability Management, Data Logging, Information Technology, Tenable Nessus, CIS Benchmarks, Vulnerability Analysis
- **Published:** October 25, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=7246f37e08c4ea40

## About the Role

This is a broad, practical role supporting multiple specialized security environments within a large organization. The ISSM will work across security documentation, compliance, technical analysis, and hands-on implementation. Routine user support is handled by cleared technical staff, but the ISSM must be able to perform ISSO and limited systems administration work when needed. Success requires initiative, curiosity, sound judgment, attention to detail, and a willingness to work outside a narrowly defined lane., * Must be a US Citizen with Active DoD Top Secret/SCI clearance.

 * Security+ or another applicable cybersecurity certification.
 * Associate degree with at least seven years, bachelor's degree with at least three years, or an equivalent combination of education and relevant experience in information technology, cybersecurity, information assurance, or classified systems.
 * Practical experience supporting RMF authorization and continuous monitoring, including substantive contributions to an ATO package, control documentation, assessment evidence, or vulnerability remediation.
 * Working knowledge of NIST SP 800-53, RMF, security controls, POA&Ms, and the requirements to obtain and maintain an ATO.
 * Hands-on ability with Windows systems, identity and access management, networks, logging, vulnerability scanning, security baselines, and troubleshooting.
 * Strong technical writing and communication skills, with the ability to work independently, manage competing priorities, collaborate with technical and nontechnical stakeholders, and seek assistance when appropriate.

Preferred Qualifications:

 * Experience serving as an ISSM. WRA will also consider experienced ISSOs who have contributed substantially to authorization and continuous monitoring activities and are ready to assume broader responsibility.
 * Experience taking a system through authorization, reauthorization, or a significant continuous monitoring cycle. Final ownership of a complete ATO package is preferred but not required.
 * Familiarity with eMASS, ICD 503, SAP or SAR environments, or sponsor-specific authorization processes.
 * Knowledge of CMMC, NIST SP 800-171, DFARS cybersecurity requirements, IntelliGRC or another GRC platform, and common security tools for vulnerability scanning, logging, endpoint protection, or configuration compliance.
 * CISSP, CISM, or another advanced security certification.

## Description

* Classified systems and RMF: Manage and support authorization, reauthorization, and continuous monitoring for government-sponsored classified systems and local facilities.
 * Develop and maintain ATO packages and supporting artifacts, including System Security Plans, control implementation statements, assessment evidence, POA&Ms, agreements, test plans, and technical documentation.
 * Perform control assessments, self-inspections, vulnerability management, recurring reporting, and security-impact reviews; coordinate changes and authorization matters with government security stakeholders.
 * Maintain authorization information and evidence in eMASS or sponsor-specific systems. Prior eMASS experience is helpful but not required.
 * CMMC and CUI enclave: Help lead WRA's CMMC program and CUI enclave, including NIST SP 800-171 documentation, evidence, policies, POA&Ms, access and change reviews, continuous monitoring, assessment preparation, and remediation tracking.
 * Use IntelliGRC to maintain CMMC documentation and evidence, and coordinate shared responsibilities and deliverables with WRA's managed service provider (MSP) and external consultants. Prior IntelliGRC experience is not required.
 * Hands-on security: Review logs, configure controls such as multifactor authentication, use vulnerability and compliance scanning tools, apply and remediate SRGs and STIGs, investigate findings, and validate corrective actions.
 * Perform ISSO or limited systems administration duties for specific programs and serve as backup to cleared technical staff when needed. This is not primarily a help desk position.
 * Support incident response, required reporting, policy and training activities, and clear communication of authorization status, vulnerabilities, risks, and remediation.
 * Research unfamiliar requirements and technologies, develop practical recommendations, and perform other related security and IT duties in a small, collaborative environment.