Information Systems Security Manager

AFS is seeking a highly skilled and experienced Lead Information System Security Manager who operates at the intersection of ISSM and ISSO responsibilities.As an Information Systems Security Manager, you will oversee the security posture of cloud and network infrastructures, ensuring that all systems comply with relevant standards and regulations. Your responsibilities will include conducting thorough ATO (Authorization to Operate) assessments, identifying vulnerabilities, and implementing robust security controls to mitigate risks. You will be expected to develop and enforce security policies, monitor compliance, and respond to security incidents with effective remediation strategies. Collaborating with cross-functional teams, you will play a key role in maintaining the integrity and confidentiality of organizational data. To excel in this position, familiarity with tools such as vulnerability scanners, SIEM platforms, and compliance management software will be highly beneficial. Experience with cloud service providers, network segmentation, and incident response frameworks will support your ability to secure complex environments. A background in managing compliance audits, developing risk management plans, and leading security awareness initiatives will further enhance your effectiveness in this role. Exposure to regulatory frameworks and best practices in information security will help you navigate the evolving landscape of threats and compliance requirements.

The ideal candidate will have a deep understanding of implementing security measures across enterprise systems, applying governance frameworks, and engineering secure solutions for traditional infrastructure, cloud environments, DevSecOps pipelines, and containerized platforms. This role requires strong RMF leadership, advanced security engineering expertise, and hands-on technical execution across Linux, Windows, cloud, and container ecosystems. The Information System Security Manager will secure systems throughout their entire lifecycle from initial design and accreditation through continuous monitoring while working collaboratively with cross-functional teams to ensure cybersecurity is embedded into every aspect of the organization’s IT infrastructure.

Responsibilities:

• Lead RMF activities across the system lifecycle and maintain required security documentation.
• Ensure compliance with applicable security frameworks and support all ATO processes.
• Conduct security impact analysis for system, infrastructure, and application changes.
• Manage RMF packages in enterprise GRC platforms and drive timely POA&M closure.
• Track and report on security control performance, coordinate remediation with technical teams, and support audits through clear cybersecurity metrics
• Experience with ATO Assessment, compliance, cloud and networks infrastructure security, 

Qualifications:

• Bachelor’s degree or equivalent experience (8+ years), or advanced degree with 5+ years of experience.
• up to 25% TDY Travel OCONUS
• Years of experience can be in any of the following areas:
  • Strong understanding of the Risk Management Framework (RMF) and security governance principles.
  • Knowledge of Linux/Unix operating systems and their administrative concepts.
  • Familiarity with containerization and orchestration platforms (e.g., Docker, Kubernetes).
  • Ability to interpret and apply DISA STIG requirements across traditional, cloud, and containerized environments.
  • Proficiency in at least one scripting or automation language (e.g., Bash, Python, Go, Rust).
  • Strong analytical and problem solving capabilities with the ability to work effectively in dynamic environments.
• DoD 8570/8140 IAM/IAT Level III compliant certification(s).

Nice to Have Qualifications: 

• Background in DevSecOps, security automation, or secure CI/CD pipeline integration.
• Experience with cloud security across platforms such as AWS, Azure Government, or GovCloud.
• Advanced Kubernetes security experience beyond basic administration.
• Experience developing Infrastructure as Code (IaC) and automating deployments. 
• Experience with DevOps tools and workflows (e.g., Jenkins, Git, Ansible, Terraform).
• Additional professional certifications, such as:
  • AWS DevOps Professional
  • Certified Kubernetes Security Specialist (CKS)
  • GIAC Cloud Security Automation (GCSA)
  • Certified DevSecOps Professional (CDP)

• Broader programming or automation experience beyond core scripting languages. Skills ATO Assessment, compliance, cloud and networks infrastructure security, 

Clearance:

• An active TS/SCI is required

The pay range for the states of California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia is: 147900 - 175400 USD