Principal Information Systems Security Manager; ISSM Nuclear Weapon Systems

Company: Valor 3 Services, LLC
Client: National Nuclear Security Administration (NNSA)
Location: Albuquerque, New Mexico
Work Arrangement: Hybrid/On-site, based on contract and client requirements
Position Type: Full-Time
Clearance: Active DOE Q or DoD Top Secret with eligibility and access to Critical Nuclear Weapon Design Information (CNWDI) and Sigma 15

Valor 3 Services, LLC is seeking an experienced Principal Information Systems Security Manager (ISSM) to provide cybersecurity subject matter expertise in support of the National Nuclear Security Administration (NNSA) and its nuclear weapon programs.

The successful candidate will provide high-level technical advisory, systems security engineering, and risk management support for Nuclear Weapon Information Technology (NW-IT), operational technology (OT), and weapon-enabling systems throughout their acquisition life cycles.

This position requires extensive experience with the Risk Management Framework (RMF), system security architecture, supply chain risk management, and cybersecurity requirements associated with highly sensitive and classified systems.

As a contractor supporting NNSA, the selected candidate will provide technical analysis, recommendations, documentation, and coordination in support of Federal decision-makers. The position will not perform inherently governmental functions, including official risk acceptance or execution of Authorizations to Operate (ATOs).

Cybersecurity & Risk Management Framework (RMF)

• Facilitate implementation of the NIST Risk Management Framework in accordance with NIST SP 800-37, CNSSI 1253, DOE cybersecurity requirements, and other applicable guidance for classified, specialized, and non-standard weapon-related systems.
• Develop, update, and maintain authorization and assessment documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and Continuous Monitoring (Con Mon) plans.
• Develop tailored security control profiles and identify compensating controls for embedded IT, telemetry systems, flight-test configurations, operational technology, and other systems supporting nuclear weapon programs.
• Conduct technical vulnerability analyses, risk assessments, and impact analyses and develop recommended mitigation strategies for Federal review.

Systems Security Engineering & Acquisition Support

• Work with weapon product teams to integrate Systems Security Engineering (SSE) and cybersecurity requirements throughout the Joint DOE/DoD Nuclear Weapons Life Cycle.
• Develop and review cybersecurity requirements for technical specifications, Statements of Work (SOWs), Interface Control Documents (ICDs), and other acquisition documentation.
• Support Nuclear Enterprise Assurance (NEA) activities through Supply Chain Risk Management (SCRM) and Software Assurance (SwA) evaluations.
• Evaluate risks associated with hardware and software subversion, counterfeit components, tampering, and other supply chain vulnerabilities.
• Review security aspects of weapon-enabling systems, Joint Test Assemblies (JTAs), ground support test equipment, and related systems for compliance with applicable anti-subversion and anti-tamper requirements.

Stakeholder & Program Coordination

• Provide technical cybersecurity and information security risk advice to Federal program and cybersecurity leadership.
• Support coordination with Department of Defense and military service counterparts to align cybersecurity requirements, system boundaries, and security approaches for joint nuclear weapon programs.
• Participate in technical working groups, Nuclear Weapon System Safety Groups (NWSSGs), safety studies, and other activities involving cyber-physical systems and delivery-platform interfaces.
• Coordinate cybersecurity activities across multiple National Nuclear Security Enterprise sites, including national laboratories and production facilities.
• Communicate complex cybersecurity risks, requirements, and mitigation strategies to Federal leadership, engineers, security professionals, and other technical stakeholders.

Continuous Monitoring & Program Support

• Monitor and report on cybersecurity compliance and security posture for systems within the assigned portfolio.
• Track POA&M items and coordinate with system administrators, engineers, and other stakeholders to support timely remediation.
• Support the analysis, containment, coordination, and reporting of potential cybersecurity incidents and vulnerability…