Information Systems Security Manager, RMF and CMMC

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Baltimore - Acct/IT/Repr. Full Time Baltimore, MD, US

WRA is seeking a hands‑on Information Systems Security Manager to support classified information systems, lead Risk Management Framework authorization and continuous monitoring activities, and help operate WRA's CMMC program and CUI enclave. The position is ideal for an ISSM or experienced ISSO ready to grow into broader program ownership.

This is a broad, practical role supporting multiple specialized security environments within a large organization. The ISSM will work across security documentation, compliance, technical analysis, and hands‑on implementation. Routine user support is handled by cleared technical staff, but the ISSM must be able to perform ISSO and limited systems administration work when needed. Success requires initiative, curiosity, sound judgment, attention to detail, and a willingness to work outside a narrowly defined lane.

Responsibilities:

• Classified systems and RMF: Manage and support authorization, reauthorization, and continuous monitoring for government-sponsored classified systems and local facilities.
• Develop and maintain ATO packages and supporting artifacts, including System Security Plans, control implementation statements, assessment evidence, POA&Ms, agreements, test plans, and technical documentation.
• Perform control assessments, self‑inspections, vulnerability management, recurring reporting, and security‑impact reviews; coordinate changes and authorization matters with government security stakeholders.
• Maintain authorization information and evidence in eMASS or sponsor‑specific systems. Prior eMASS experience is helpful but not required.
• CMMC and CUI enclave: Help lead WRA's CMMC program and CUI enclave, including NIST SP 800‑171 documentation, evidence, policies, POA&Ms, access and change reviews, continuous monitoring, assessment preparation, and remediation tracking.
• Use IntelliGRC to maintain CMMC documentation and evidence, and coordinate shared responsibilities and deliverables with WRA's managed service provider (MSP) and external consultants. Prior IntelliGRC experience is not required.
• Hands‑on security: Review logs, configure controls such as multifactor authentication, use vulnerability and compliance scanning tools, apply and remediate SRGs and STIGs, investigate findings, and validate corrective actions.
• Perform ISSO or limited systems administration duties for specific programs and serve as backup to cleared technical staff when needed. This is not primarily a help desk position.
• Support incident response, required reporting, policy and training activities, and clear communication of authorization status, vulnerabilities, risks, and remediation.
• Research unfamiliar requirements and technologies, develop practical recommendations, and perform other related security and IT duties in a small, collaborative environment.

Requirements:

• Must be a US Citizen with Active DoD Top Secret/SCI clearance.
• Security+ or another applicable cybersecurity certification.
• Associate degree with at least seven years, bachelor's degree with at least three years, or an equivalent combination of education and relevant experience in information technology, cybersecurity, information assurance, or classified systems.
• Practical experience supporting RMF authorization and continuous monitoring, including substantive contributions to an ATO package, control documentation, assessment evidence, or vulnerability remediation.
• Working knowledge of NIST SP 800‑53, RMF, security controls, POA&Ms, and the requirements to obtain…