Information System Security Manager; ISSM

Description

Job Title: Information System Security Manager (ISSM)

Place of Performance: Springfield, VA

Mandatory Requirements: TS/SCI Clearance

Experience Level: Sr Level (8-10+ years)

On-Site, hybrid, remote: On-Site

Travel: Minimal / As Required

With more than 20 years of securing some of the U.S. Department of Defense and the Intelligence Community’s most critical networks, JFL Consulting, LLC provides advanced network security solutions to a range of US Government and US commercial clients. Our cybersecurity operators are experts at assessing and defending mission-critical data and the networks that facilitate their operation. We are focused on delivering advanced products and industry best practices that meet each customer’s unique requirements.

Visit

• Salary: $155k - $175k
• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• We support your growth through certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms

The Information System Security Manager (ISSM) serves as the senior cybersecurity authority and technical subject matter expert (SME) responsible for overseeing and maintaining the security posture, compliance, and risk management of assigned enterprise information systems. The primary responsibility for this role is directing cybersecurity and authorization activities supporting an ongoing program; however, the ISSM will also support other critical defense projects and initiatives as operational needs evolve and related mission partner efforts.

Operating under Department of Defense guidelines (DoDI 8500.01 and DoDI 8510.01), the ISSM directs Risk Management Framework (RMF) lifecycle activities, advises Authorizing Officials (AOs) and Security Control Assessors (SCAs), supervises cybersecurity personnel, and collaborates across engineering teams to secure and maintain continuous Authorizations to Operate (ATO).

• Lead the implementation, governance, and execution of DoD Risk Management Framework (RMF) policies and lifecycle activities across all assigned networks and systems in accordance with DoDI 8500.01, DoDI 8510.01, and NIST SP 800-53 Rev. 5.
• Lead periodic and recurring RMF policy updates and reviews, ensuring organizational security policies, baselines, and implementation standards remain fully aligned with emerging federal and DoD directives.
• Serve as the primary cybersecurity technical advisor to the Authorizing Official (AO) and program leadership.
• Direct the assembly, review, approval, and maintenance of complete security authorization packages within eMASS, Xacta, or applicable tools, including:
  • System Security Plans (SSPs)
  • Security Assessment Reports (SARs)
  • Plans of Action and Milestones (POA&Ms)
  • Security Control Traceability Matrices (SCTMs)
  • Contingency Plans and incident response procedures
• Monitor POA&Ms mitigation actions, ensure compliance timelines are met, and manage residual risks.
• Ensure the system and information owner processes, stores, displays, and transmits classified information strictly on authorized systems in compliance with handling and access control mandates commensurate with classification levels.
• Maintain an authoritative, centralized repository for all system cybersecurity-related documentation and artifacts.

• Serve as an active voting member of the…