Information System Security Manager

Security Manager - ISSM

LOCATION: Eglin AFB, FL

JOB STATUS: Full-time

CLEARANCE: Secret; TS/SCI

CERTIFICATION: DoD 8140 Advanced Proficiency Certification

TRAVEL: 10%

Astrion has an exciting opportunity for an Information System Security Manager (ISSM) supporting the 96 Test Wing under the Air Force Division located at the Eglin AFB, FL.

REQUIRED QUALIFICATIONS / SKILLS

• Must have an active DoD Secret security clearance.
• The ideal candidate will have 10+ years’ experience as an ISSM/ISSE/ISSO/System Administrator/Network Administrator.
• Master’s Degree in applicable discipline; additional experience may be substituted for the degree.
• DoD 8140 Advanced Proficiency Certification for ISSM or related position.
• Experience with the system security engineering lifecycle for Department of War (DoW)/Department of The Air Force (DAF) programs: They'd understand how security is integrated into the acquisition process, from requirements definition to verification testing and deployment.
• Experience with DoW/DAF Cybersecurity requirements and Risk Management Framework authorization processes.
• Experience managing and executing cybersecurity incident response processes and reporting requirements.
• Experience with the Enterprise Mission Assurance Support Service (eMASS), Assured Compliance Assessment Solution (ACAS), and endpoint security tools (e.g., ESS/MS Defender Suite for Endpoint/Server).
• Experience managing, executing, and reporting on cybersecurity continuous monitoring requirements to include implementing and monitoring Security Technical Implementation Guide (STIG) requirements.

PREFERRED QUALIFICATIONS / SKILLS 

• Active Top Secret DoD security clearance

RESPONSIBILITIES

• The candidate shall provide advice and assistance services in support of the implementation of cybersecurity safeguards while developing, coordinating, and implementing short- and long-term strategies during all phases of the system development lifecycle.
• Develop, assess, write, manage, and maintain Interim Authority to Test (IATT), Authority to Operate (ATO), and Security Impact Analysis (SIA).
• Oversee implementation of Security Technical Implementation Guide (STIG) requirements, while interpreting and integrating all applicable policies, instructions, and procedures according to appropriate Security Classification Guides (SCGs).
• Maintain DoD 8140 Advanced Proficiency Certification for ISSM or related position (e.g., Certified Information Systems Security Professional (CISSP)).
• Ensuring the confidentiality, integrity, and availability of classified ISs and data using DoW/DAF approved security engineering standards, industry best practices, and by employing new technologies.
• Advise and assist the Government in performing initial and recurring Authorization of systems or networks at the appropriate protection level as directed by the appropriate cognizant authority.
• Security Planning and Documentation: The ISSM develops and maintains essential security documentation, including:
• System Security Plan (SSP): A comprehensive document that describes the security controls implemented on the system.
• Security Assessment Report (SAR): Documents the results of security assessments and identifies any vulnerabilities.
• Plan of Action and Milestones (POA&M): Tracks the progress of remediating vulnerabilities and implementing security controls.
• Assessment and Authorization (A&A): The ISSM plays a vital role in the A&A process, which is the process of obtaining authorization to operate (ATO) a system. This involves:
• Preparing the system for security assessments.
• Working with security assessors to identify vulnerabilities.
• Developing and implementing corrective action plans.
• Presenting the system to the Authorizing Official (AO) for approval.
• Configuration Management: The ISSM ensures that the information system is configured securely and that all changes are properly authorized and documented.
• Access Control: The ISSM manages access control to the information system, ensuring that only authorized users have access to sensitive data.
• Vulnerability Management: The ISSM identifies, assesses, and mitigates vulnerabilities in the information system. This involves:
• Conducting vulnerability scans.
• Applying security patches.
• Implementing other security measures to protect against known vulnerabilities.
• Collaboration and Communication: The ISSM works closely with other cybersecurity professionals, system administrators, program managers, and other stakeholders to ensure that the information system is secure.
• They need to communicate effectively with both technical and non-technical audiences.