Information System Security Manager (ISSM) 2 at Crestview Management, LLC

Lincoln, Massachusetts, United States -

Full Time

Start Date

Immediate

Expiry Date

18 Jul, 26

Salary

150000.0

Posted On

20 Apr, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Information System Security, Risk Management Framework, JSIG, DoD Security, Special Access Programs, Cybersecurity, Network Security, Security Assessment, Authorization to Operate, Configuration Management, Vulnerability Assessment, Security Incident Response, Security Training, Policy Development, Hardware Sanitization

Industry

Description

Information System Security Manager (ISSM) 2 Location: Hanscom AFB, MA Clearance: TS/SCI Salary: $145,000 – $150,000 Sandy Mac Evolution LLC is seeking an experienced Information System Security Manager (ISSM) to support Department of Defense (DoD) Special Access Programs (SAP). The ISSM will serve as a principal advisor on all matters—technical and non-technical—related to the security of information systems under their purview, supporting organizations such as Headquarters Air Force, Office of the Secretary of Defense, and other military compartmented efforts. All applicants must apply through the Sandy Mac Evolution LLC (SME) website. This position provides day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities. Requirements Key Responsibilities Perform oversight of the development, implementation, and evaluation of information system security program policy, with emphasis on integration of existing SAP network infrastructures Develop and oversee operational information systems security implementation policy and guidelines for network security based on the Risk Management Framework (RMF), with emphasis on the Joint Special Access Program Implementation Guide (JSIG) authorization process Advise customers on RMF assessment and authorization (A&A) issues Perform risk assessments and provide recommendations to DoD agency customers Advise government program managers on security testing methodologies and processes Evaluate authorization documentation and provide written recommendations for authorization to government Program Managers Develop and maintain a formal Information Systems Security Program Ensure IAOs, network administrators, and cybersecurity personnel receive required technical and security training Develop, review, endorse, and recommend action by the Authorizing Official (AO) or Designated Authorizing Official (DAO) for system assessment documentation Ensure approved procedures exist for clearing, sanitizing, and destroying hardware and media Develop and execute security assessment plans verifying required protection-level controls Maintain repositories for all system authorization documentation and modifications Establish and implement Configuration Control Board (CCB) charter processes Develop policies and procedures for responding to security incidents, including investigation and reporting Ensure corrective actions are implemented when vulnerabilities or incidents are identified Ensure data ownership and responsibilities are defined for each authorization boundary, including access controls and handling requirements Develop and implement security education, training, and awareness programs, including presenting cybersecurity training Evaluate threats and vulnerabilities to determine if additional safeguards are required Assess system and environmental changes that may impact authorization status Ensure valid Authorization to Operate (ATO) determinations exist for all systems under their purview Review Automated Information System (AIS) assessment plans Coordinate with Program Security Officers (PSO) or cognizant security officials for approval of external information systems Conduct periodic security posture assessments across authorization boundaries Ensure configuration management (CM) is enforced for all security-relevant system changes Ensure periodic testing is conducted using intrusion detection and monitoring tools (shared responsibility with ISSOs) Ensure system recovery and reconstitution processes are developed and maintained based on availability requirements Ensure all authorization documentation remains current and accessible to authorized personnel Ensure system security requirements are addressed throughout all phases of the system lifecycle Develop Assured File Transfers (AFT) in accordance with JSIG requirements Participate in self-inspections Perform ISSO duties when necessary or when an ISSO is not available Special Requirements Mandatory: 5–7 years of related experience Desired: SAP experience Education: Bachelor’s degree (preferred) – counts as 4 years of experience Associate’s degree (related field) – counts as 2 years of experience Experience/Education Equivalents: Security Fundamentals Professional Certification (SFPC) = 1 year experience Special Program Security Certification (SPSC) = 1 year experience Maximum equivalent experience for SPED certifications: 3 years total

Responsibilities

The ISSM will serve as a principal advisor on all technical and non-technical security matters for DoD Special Access Programs. They are responsible for overseeing information system security policies, conducting risk assessments, and ensuring compliance with RMF and JSIG standards.