Information Systems Security Manager (ISSM)

The ISSM is responsible for the system’s cybersecurity program, security posture, and compliance, and serves as the primary interface with the Authorizing Official (AO), Security Control Assessor (SCA), SCA Representative (SCAR), Authorizing Official Designated Representative (AODR), and government stakeholders. The ISSM leads and coaches the Information Systems Security Engineer (ISSE) and Information Systems Security Officer (ISSO), and partners with the Program Manager (PM)/Information System Owner (ISO), developers, DevSecOps engineers, and the cloud service provider and enterprise cloud management points of contact to plan, implement, assess, and continuously monitor security controls in accordance with NIST and CNSS guidance., Cloud Inheritance and Authorization: Map and validate inherited controls from AWS GovCloud and the hosting enclave’s common control providers, document the customer responsibility matrix, and assess and authorize cloud environments at IL2, IL4, and IL5 in accordance with the DoD Cloud Computing SRG and the cloud service provider’s FedRAMP and DoD provisional authorizations.

AWS Security Services: Configure, review, and use Amazon CloudWatch (logs, metrics, and alarms), AWS CloudTrail, AWS Security Hub, Amazon GuardDuty, AWS Config, AWS Identity and Access Management (IAM), AWS Key Management Service (KMS), and Amazon EventBridge and Amazon SNS alert routing as assessment evidence and continuous monitoring sources.

Cloud Platform Security: Partner with engineering on the security of Amazon Elastic Kubernetes Service (EKS), Amazon EC2, Amazon S3, Amazon RDS, Application Load Balancers, VPC and security group design, AWS Certificate Manager, and infrastructure as code (Terraform and Helm), validating that the deployed state matches the authorized baseline.

Application Security Scanning: Establish and manage the scanning program required for authorization and continuous monitoring: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), software composition analysis, Software Bills of Materials (SBOMs), container image scanning against hardened base images (Iron Bank and Chainguard), and vulnerability and compliance scanning, with documented justification and mitigation for every open finding.

STIG and SRG Compliance: Enforce Security Technical Implementation Guide (STIG) and SRG compliance across the application, Kubernetes, and cloud layers (for example, the Application Security and Development STIG, the Kubernetes STIG, and the DoD Cloud Computing SRG), direct checklist generation, review, and retest, and reconcile checklist findings with eMASS control statuses.

eMASS Management: Maintain eMASS records, packages, and artifacts end to end: system registration and metadata, control set and inheritance selection, test results and the artifact library, PPSM and hardware and software uploads, workflow submission, and the monthly, quarterly, and annual maintenance cycles.

POA&M and Vulnerability Management: Develop and maintain Plan of Action and Milestones (POA&M) items with accurate milestones, mitigations, and estimated completion dates; ensure traceability of every technical finding from scan results, STIG and SRG checklists, and AWS Security Hub to an approved POA&M item; and conduct vulnerability and risk analysis in support of residual risk determinations.

Continuous Monitoring: Drive the continuous monitoring cadence: develop, execute, and report the Continuous Monitoring (ConMon) plan, including recurring evidence submissions to the SCA and AO and the monthly cyber posture briefing, and satisfy the conditions of authorization on schedule.

AI System Security: Apply security and governance to AI and agent-based applications, including model access controls, guardrails, PII redaction, and monitoring and execution tracing that supports real-time and retrospective reconstruction of agent actions and decision rationale.

Team Leadership: Lead and coach the ISSE and ISSO: assign and review control implementation, evidence collection, and remediation work; set the daily battle rhythm; run tiger team sessions with developers and subject matter experts; and report status, blockers, and required decisions to program leadership.

Stakeholder Coordination: Serve as the primary point of contact to the AO, SCA, SCAR, and AODR; the CSSP; the cloud hosting and enterprise cloud management organizations; penetration test teams (scope, rules of engagement, and scheduling); and the privacy office (Privacy Impact Assessment, System of Records Notice, and Privacy Overlay requirements).

Policy and Procedure: Draft, review, and maintain cybersecurity policies, standard operating procedures, and plans in accordance with DoDI 8510.01, the Federal Information Security Modernization Act (FISMA), NIST Special Publications, CNSS guidance, and direction from leadership. Ability to work effectively independently as well as within a team environment.

The candidate should possess expert knowledge of the RMF, Authorization to Operate (ATO) package requirements, and eMASS, together with a working understanding of how artificial intelligence (AI) and agent-based applications are secured, assessed, and monitored., RMF Lifecycle Leadership: Drive the RMF lifecycle from system categorization and control tailoring (NIST SP 800-53 Rev 5) through ATO and continuous monitoring, including the rolling assessment cadence with the SCA, SCAR, and AODR, live demonstration sessions, evidence development, AO briefings, and the ATO package documentation: the System Security Plan, hardware and software list, Ports, Protocols, and Services Management (PPSM), authorization boundary and data flow diagrams, Concept of Operations, IT Categorization and Selection Checklist, and standard operating procedures., * Top Secret clearance with SCI eligibility (verifiable in DISS)

• BA/BS college degree
• DoD 8140 qualified for work role 722, Information Systems Security Manager (for example, CISSP or CISM)
• Strong knowledge of the RMF and NIST SP 800-53 Rev 5 security controls, DoDI 8510.01, and the DoD Cloud Computing SRG
• Experience assessing and authorizing cloud environments at Impact Levels 2, 4, and 5
• Hands-on experience securing Amazon Web Services, including CloudWatch, CloudTrail, Security Hub, EKS, and EC2
• Experience managing SAST, DAST, and software composition analysis scanning programs and reconciling results with STIG and SRG checklists and POA&Ms
• Experience leading an RMF effort as an ISSM or equivalent, including direct work with the AO, SCA, SCAR, and AODR and leadership of ISSEs and ISSOs
• Expert-level experience using eMASS, * Seven (7) years or more of documented/relevant experience in information system security management, RMF, and ATO support, including cloud-hosted systems
• Familiarity with AI and machine learning security frameworks, including the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework
• Familiarity with FedRAMP and DoD provisional authorization inheritance and customer responsibility matrices
• Familiarity with Kubernetes security (admission control, network policy, and service mesh), container hardening with Iron Bank and Chainguard images, and GitLab CI/CD pipelines
• Familiarity with Terraform and Helm, including validating infrastructure as code against the authorized baseline
• Familiarity with identity federation and CAC/PKI authentication (Keycloak, SAML, OIDC, or equivalent)
• Familiarity with privacy requirements (DD Form 2930 Privacy Impact Assessment, SORN, and Privacy Overlay) and CSSP onboarding
• Familiarity with penetration test coordination, including rules of engagement and findings handling
• Familiarity with NIST SP 800-37, 800-53A, and 800-137 and CNSSI 1253

Pay: $150,000.00 - $160,000.00 per year

Application Question(s):

• This is a full-time 1099 independent consultant position. You will be paid as a contractor, with no taxes withheld and no company-provided benefits (health insurance, PTO, or retirement), and you will be responsible for your own taxes and insurance. Are you willing to work under a 1099 arrangement?

Security clearance:

• Top Secret (Required)

Work Location: Hybrid remote in Pentagon, DC 20301

The ISSM drives the RMF lifecycle from system categorization through authorization (Interim Authorization to Test, ATO, and ATO with conditions) and continuous monitoring across development, test, and production environments in a cloud enclave, including control inheritance from the cloud service provider and the hosting environment, Cybersecurity Service Provider (CSSP) onboarding, penetration test coordination, privacy requirements, and the conditions of authorization that follow.