Information System Security Manager; ISSM

Overview

LMI is a new breed of digital solutions provider dedicated to accelerating government impact with innovation and speed. Investing in technology and prototypes ahead of need, LMI brings commercial-grade platforms and mission-ready AI to federal agencies at commercial speed.

Leveraging our mission-ready technology and solutions, provenexpertisein federal deployment, and strategic relationships, we enhance outcomes for the government, efficiently and effectively. With a focus on agility and collaboration, LMI serves the defense, space, homeland, healthcare, and intelligence sectors—helping agencies navigate complexity and outpace change.

Headquartered in Tysons, Virginia, LMI is committed to delivering impactful results that strengthen missions and drive lasting value.

LMI is seeking a skilled Information System Security Manager (ISSM) to assist the Lead Cybersecurity Integrator to lead security authorization, governance, and continuous monitoring for enterprise IT capabilities across new and existing secure facilities. The ISSM will coordinate with system owners, engineers, security officers, cybersecurity personnel, and government stakeholders to ensure systems are designed, documented, authorized, operated, and sustained in accordance with security requirements.

This is an execution-oriented role supporting a fast-paced, milestone-driven prototype effort with near-term deliverable commitments. Success requires risk-based judgment, rigorous Risk Management Framework execution, clear communication, and the ability to balance mission, security, operational risk, and delivery timelines.

Primary duties include:

• Lead Risk Management Framework implementation across the system lifecycle, including categorization, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.

• Develop security authorization strategies and roadmaps for classified and unclassified systems, multi-enclave environments, and interconnected capabilities.

• Coordinate system security plans, implementation evidence, plans of action and milestones, assessment packages, authorization decisions, and monitoring artifacts.

• Interpret and apply NIST SP 800-37, NIST SP 800-53, CNSSI 1253, defense and intelligence guidance, customer policies, and program requirements.

• Advise the Lead Cybersecurity Integrator, system owners, the Chief Engineer, program leadership, and technical teams on cyber risk, control gaps, remediation priorities, and risk acceptance.

• Integrate security requirements into architecture, engineering, acquisition, change management, testing, deployment, operations, and sustainment.

• Oversee vulnerability, configuration, and compliance monitoring; prioritize remediation based on exploitability, mission impact, exposure, and operational consequence.

• Coordinate assessors, authorizing officials, security officers, engineers, operators, and stakeholders through reviews, audits, incidents, and authorization milestones.

• Automate evidence collection, control validation, reporting, plan-of-action tracking, and monitoring while preserving auditability and human oversight.

Foundational Skills

• Risk Management Framework and security authorization lifecycle principles.

• NIST SP 800-37, NIST SP 800-53, CNSSI 1253, and federal, defense, and intelligence security-control frameworks.

• System security plans, control traceability, evidence, assessments, plans of action and milestones, and authorization packages.

• Risk assessment, security-control tailoring, compensating controls, residual risk, and risk acceptance.

• Continuous monitoring, vulnerability management, secure configuration, patching, and compliance assessment.

• Systems, networking, cloud, identity, application, data, and operational-security fundamentals.

• Zero-trust, least-privilege, defense-in-depth, segmentation, and secure-boundary principles.

• Configuration, change, incident, problem, and technology-lifecycle management.

• Security automation, metrics, technical writing, briefings, and stakeholder coordination.

Location: This position is based in the Washington, DC metro area, with travel to program locations.

Travel: This position requires approximately 25-50% travel to support activities across multiple program locations.

Availability: Immediate availability strongly preferred; unclassified planning work may begin while program access nominations are processed.

Required:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology,…