Information System Security Manager

Position Title:
Information System Security Manager

Location:
Hill AFB, Utah (on-site)

Clearance:
*** Active Secret Clearance Required***

Salary: $ - $

The Information Systems Security Manager (ISSM) serves as the cybersecurity subject matter expert responsible for leading cybersecurity, Risk Management Framework (RMF), Authorization to Operate (ATO), vulnerability management, and continuous monitoring activities supporting U.S. Air Force mission systems and infrastructure. The position provides technical and compliance leadership across program cybersecurity activities and serves as a primary cybersecurity interface between program leadership, engineering and operations teams, customers, and Authorizing Official (AO) stakeholders.

The ISSM is responsible for managing multiple system authorization packages, including program and customer ATOs, and ensuring systems maintain an acceptable cybersecurity posture throughout the system lifecycle. The position leads implementation of DoD and Department of the Air Force cybersecurity requirements, including DoD RMF, NIST SP 800-53, DISA Security Technical Implementation Guides (STIGs), vulnerability management, continuous monitoring, and associated cybersecurity documentation.

This position also provides cybersecurity leadership supporting modernization of legacy Air Force infrastructure and transition of services to approved hosting and cloud environments.

• Provides technical leadership, direction, prioritization, and oversight for cybersecurity activities across the program.
• Coordinate cybersecurity activities across ISSOs, security engineers, system administrators, infrastructure teams, application teams, program management, customers, and other mission stakeholders.
• Manage multiple systems through the complete DoD Risk Management Framework lifecycle and maintain Authorization to Operate (ATO) packages within eMASS.
• Lead development, maintenance, and execution of program ATO packages and two customer ATO packages, including security controls, implementation statements, artifacts, assessment evidence, POA&Ms, continuous monitoring requirements, and authorization documentation.
• Serve as a primary cybersecurity point of contact for customer security organizations, assessors, Authorizing Official representatives, and other authorization stakeholders.
• Interpret and implement DoD RMF, NIST SP 800-53, Department of the Air Force, DISA, and applicable cybersecurity requirements across program systems and authorization boundaries.
• Develop and maintain system security documentation, including System Security Plans, continuous monitoring documentation, control implementation evidence, security procedures, risk documentation, and other RMF artifacts.
• Lead vulnerability management activities, including ACAS/Tenable scanning, vulnerability analysis, remediation prioritization, POA&M management, risk acceptance activities, and coordination of remediation efforts with infrastructure and sustainment teams.
• Oversee DISA STIG implementation and compliance activities, including STIG checklist development, validation of findings, documentation of applicability, and coordination of remediation with technical system owners.
• Monitor cybersecurity compliance and system security posture through continuous monitoring, vulnerability assessments, security control reviews, and analysis of technical and operational risk.
• Provide cybersecurity risk assessments and recommendations to Program Management and customer leadership, translating technical vulnerabilities and compliance deficiencies into mission and program risk.
• Develop, maintain, and communicate cybersecurity risks within the program risk register and coordinate…