Information Systems Security Manager

Standard Job Description

The incumbent will serve as the senior ISSM for Department of War (DoW) program. , providing strategic and tactical leadership for all information‑system security activities. This role demands deep expertise in the Risk Management Framework (RMF), cyber risk management, and the ability to navigate a highly complex program environment while coordinating across CONUS and OCONUS teams and mentoring junior security staff.

Key Responsibilities

• Lead Daily Security Operations – Own day‑to‑day information‑system security functions, addressing all technical security matters and ensuring uninterrupted protection of program assets.
• Talent Management & Mentorship – Attract, develop, and retain high‑caliber cyber professionals; provide ongoing mentorship to Information System Security Officers (ISSOs) and other junior staff, fostering a culture of continuous learning.
• Navigate Complex Program Landscape – Analyze and resolve intricate program interdependencies, conflicting requirements, and emerging security challenges; apply systems‑thinking to maintain a resilient security posture across a multifaceted environment.
• RMF Oversight – Review, approve, and manage RMF package authorizations, ensuring compliance with DoW/IC standards.
• Security Event Management – Monitor, analyze, and respond to security events; maintain incident‑response procedures and escalation paths.
• Compliance Tracking – Record all compliance actions in the approved automated tracking system; when necessary, develop and maintain Plans of Action and Milestones (POA&Ms).
• Lifecycle Governance – Ensure systems are operated, maintained, and disposed of per internal security policies; maintain comprehensive lifecycle documentation.
• Configuration Management – Enforce configuration management for security‑relevant software, hardware, firmware, and associated documentation.
• Change Evaluation – Assess proposed system changes or additions, advising stakeholders on security impact and mitigation requirements.
• Security Training & Awareness – Design and deliver IS security education and training programs for staff and contractors; mentor ISSOs in applying best‑practice controls.
• Audit & Risk Assessment – Participate in internal and external security audits/inspections; conduct risk assessments and implement remediation actions.
• Incident & Violation Investigation – Lead investigations of security violations and incidents; ensure timely corrective measures and root‑cause analysis.
• Policy Implementation – Collaborate with the CSSO to implement, enforce, and continuously improve Information Security Policies and Procedures.
• Global Coordination – Facilitate seamless coordination between CONUS and OCONUS teams to sustain a consistent, program‑wide cyber posture.

Basic Qualifications

• Currently have an active and good standing DoD 8570 IAM Level II or III certification. Proven experience (8+ years) in ISSM roles, including RMF, POA&M management, incident response, and ISSO mentorship.
• Demonstrated ability to navigate and resolve complex program‑level issues and inter‑organizational dependencies.
• Proven track record in cyber‑talent acquisition, retention, and development initiatives.
• Strong knowledge of DoW/IC cybersecurity policies, configuration management, and lifecycle processes.
• Excellent communication, stakeholder‑engagement, and problem‑solving skills across geographically dispersed teams.

Desired Skills

• Currently working in environment supporting IC customers
• Proved ability to obtain and maintain system ATOs
• Hands-on experience with ICD 503/JSIG and DAAPAM
• Experience implementing new and complex technologies at multiple classification levels within large environments and at an Enterprise level
• Bachelor’s degree from an accredited college in a related discipline, or equivalent experience/combined education, with 14 years of professional experience; or 12 years of professional experience with a related Master’s degree