Information System Security Manager; ISSM TS​/SCI

Information System Security Manager (ISSM) – TS/SCI

Information System Security Manager (ISSM) – TS/SCI AWS Cloud / RMF

Location:

Arlington, VA – Onsite

Clearance Required:

Active TS/SCI

Employment Type:

Full-Time

ABOUT SBS Strategic Business Systems, Inc. (SBS) delivers AWS-aligned mission-critical cloud, cybersecurity, software engineering, and data modernization solutions to the U.S. Department of Defense, Intelligence Community, and federal civilian agencies. We hire engineers, architects, cybersecurity professionals, and consultants who want to perform hands-on work supporting high-impact national-security programs while collaborating directly with AWS Professional Services and Federal customers. Our culture is technical, lean, and clearance-focused, with an emphasis on professional development, certifications, and long-term customer engagements.

POSITION OVERVIEW SBS is seeking an experienced Information System Security Manager (ISSM) to lead cybersecurity, Risk Management Framework (RMF), and authorization activities supporting Amazon Web Services (AWS) Federal customers operating within highly secure and classified cloud environments. The ISSM will provide overall security leadership and governance for assigned information systems and cloud environments, ensuring compliance with DoD, Intelligence Community, NIST, and customer cybersecurity requirements.

This individual will oversee the development and maintenance of Authorization to Operate (ATO) packages, continuous monitoring programs, vulnerability and risk management activities, and security control implementation across multiple security domains. The ISSM will serve as a primary cybersecurity interface between customer security leadership, Authorizing Officials and their representatives, ISSOs, ISSEs, cloud engineers, architects, and program leadership. The ideal candidate combines deep knowledge of RMF and NIST SP 800-53 with experience securing AWS cloud environments and has demonstrated the ability to lead systems through initial authorization and ongoing continuous monitoring.

Security Program Leadership

• Serve as the primary ISSM for assigned information systems and AWS cloud environments.
• Provide cybersecurity leadership, governance, and oversight throughout the system lifecycle.
• Lead and mentor ISSOs and coordinate activities across security, engineering, architecture, and operations teams.
• Establish and maintain system cybersecurity policies, procedures, and security documentation.
• Advise program leadership and customer stakeholders regarding cybersecurity risk, compliance status, and authorization strategy.
• Ensure security requirements are incorporated into system architecture, engineering, deployment, and operations.

Risk Management Framework (RMF) & Authorization

• Lead the complete RMF lifecycle in accordance with DoDI 8510.01, NIST SP 800-37, and NIST SP 800-53 Rev. 5.
• Develop and manage strategies for obtaining and maintaining IATTs and ATOs.
• Oversee development and maintenance of:
• System Security Plans (SSPs)
• Security Control Family Plans
• Security Assessment documentation
• Control Implementation Statements
• Plans of Action & Milestones (POA&Ms)
• Continuous Monitoring documentation
• Risk assessments and authorization artifacts
• Coordinate security control assessments and authorization reviews with customer security organizations and Authorizing Officials.
• Track authorization conditions, findings, vulnerabilities, and POA&M items through closure.
• Maintain system authorization packages within eMASS, Xacta, Keyhole, or equivalent GRC platforms.

AWS Cloud Security

• Provide security oversight for AWS environments supporting IL2, IL4, Secret, and Top Secret workloads.
• Assess AWS cloud architectures against applicable NIST and DoD security controls.
• Partner with cloud architects and engineers to implement secure AWS architectures and services.
• Provide oversight and guidance for AWS-native security capabilities including:
• AWS Security Hub
• Amazon Guard Duty
• AWS Config
• AWS Identity and Access Management (IAM)
• AWS Cloud Trail
• AWS Organizations
• Service Control Policies (SCPs)
• AWS Key Management Service (KMS)
• Review proposed architecture and system changes for…