Information System Security Manager – ISSM

• The Information System Security Manager (ISSM) serves as the primary cybersecurity authority and liaison for contractor-designed, built, and supported networks and systems operating within Army and Navy program environments.


• Operates on-site as a trusted advisor and peer to Government ISSMs and cybersecurity leadership, bridging the gap between contractor engineering teams and government accreditation authorities.


• Oversees the creation, defense, and maintenance of comprehensive ATO packages within key government repositories, primarily eMASS (Enterprise Mission Assurance Support Service) and Navy/Army-specific workflow databases.


• Evaluates contractor-designed architecture, software stacks, hardware configurations, and network topologies against DoD baseline security controls (NIST SP 800-53 R5, CNSSI 1253) to identify and mitigate risks early in the systems engineering lifecycle.


• Establishes robust Continuous Monitoring (ConMon) strategies, managing Plan of Action and Milestones (POA&Ms), vulnerability remediation (ACAS/Nessus scans, STIG compliance), and annual assessment reviews to prevent ATO expiration or authorization revocation.


• Serve as the primary contractor cybersecurity authority operating directly on-site with Navy Organization ISSMs, AODRs, and AOs to facilitate accreditation processes.


• Build, manage, and maintain formal Assessment & Authorization (A&A) packages within eMASS (Enterprise Mission Assurance Support Service) and relevant customer databases, ensuring accurate control allocation and implementation statements.


• Evaluate baseline security controls (NIST SP 800-53 Rev. 5, CNSSI 1253) across contractor-designed networks, verifying implementation of administrative, operational, and technical safeguards.


• Oversee automated vulnerability assessment tools (ACAS, Nessus, SCAP Compliance Checker), evaluating raw scan results, prioritizing findings, and ensuring required DISA STIGs/SRGs are applied.


• Draft, track, and remediate Plans of Action and Milestones (POA&Ms), negotiating acceptable risk levels and mitigation strategies with government stakeholders.


• Establish and execute ongoing ConMon strategies to maintain authorization boundaries, managing annual security reviews, boundary modification requests, and re-authorization events.


• Collaborate with internal software, network, and systems engineering teams during early development lifecycle phases to embed cybersecurity requirements into company-developed technology before deployment.


• Develop and enforce internal baseline configuration guides, utilizing DISA STIGs and CIS Benchmarks across company-built hardware appliances, software stacks, and operating environments.


• Evaluate internal product architectures and software deliverables for security posture, facilitating static/dynamic code analysis, dependency scanning, and zero-trust alignment.


• Establish company-internal cybersecurity standard operating procedures (SOPs), hardening checklists, and secure development guidelines to ensure consistency across product lines.


• Lead protective and corrective measures upon discovery of critical vulnerabilities or zero-day threats affecting deployed customer networks or company solutions.


• Coordinate with government security leadership and internal teams to report, contain, investigate, and remediate potential security incidents or policy non-compliance.


• Coordinate and prepare systems for formal government cybersecurity inspections, and internal quality audits.


• Advise internal engineering managers and government leadership on security posture, mission risk trade-offs, and emerging cybersecurity threats.


• Translate complex government compliance requirements (DoDI , NIST guidelines) into actionable technical requirements for internal development teams.

Requirements

• Active TS clearance (TS/SCI preferred)


• DoD 8140/8570 Baseline Certification (Required): Intermediate Level (Minimum): CompTIA Security+, CompTIA SecurityX (formerly CASP+), Cloud+, GSEC, or equivalent


• Advanced Level (Preferred): CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), GCSA, GCIA, or CISSP-ISSMP.


• Bachelors in Information Technology, Cybersecurity, Computer Science, Information Systems, Software Engineering or equivalent +5 years of relevant experience supporting Army or Navy customers in the full RMF lifecycle.


• Government RMF & Compliance Mastery Demonstrated hands‑on experience navigating the complete Risk Management Framework (RMF) lifecycle per DoDI , NIST SP 800-53 (Rev. 5), and CNSSI 1253.


• Advanced operational capability using eMASS (Enterprise Mission Assurance Support Service) to build, manage, and defend Assessment & Authorization (A&A) packages for Navy customers.


• Experience managing vulnerability assessment tools (ACAS/Nessus, SCAP Compliance Checker), evaluating raw technical scan data, and applying DISA STIGs / SRGs.


• Proven track record drafting, negotiating, and tracking POA&Ms through mitigation to secure ATO, ATO with Conditions, or Interim Authority to Test (IATT).


• Internal Product Hardening & DevSecOps Solid working knowledge of system hardening standards across operating systems (Linux/Windows), network infrastructure, containerized environments, and cloud architectures.


• Experience embedding cybersecurity requirements into early software/systems engineering workflows (Shift-Left Security / DevSecOps pipelines).


• Familiarity with static/dynamic application security testing (SAST/DAST) tools and software bill of materials (SBOM) management.


• Preferred / Desirable Qualifications Direct experience supporting Navy (NAVIFOR / NAVSEA / NAVAIR / SPAWAR) program offices and Authorizing Officials (AOs).


• Specialized certifications in audit, risk management, or cloud security (e.g., CISA, CRISC, CCSP, AWS/Azure Security Specialties).

Core Competencies

Demonstrates expertise in Cybersecurity Management, Risk Management Framework (RMF) lifecycle, and vulnerability assessment tools, with a strong focus on compliance with DoD standards and effective communication with government stakeholders.

Highest-signal resume keywords

• Active TS Clearance


• DoD 8140/8570 Baseline Certification


• Advanced Operational Capability Using eMASS


• Experience Managing Vulnerability Assessment Tools


• Internal Product Hardening & DevSecOps

ATS Optimization Keywords

Hard Skills

• Risk Management Framework (RMF)


• NIST SP 800-53


• Continuous Monitoring (ConMon)


• Assessment & Authorization (A&A)


• Vulnerability Remediation


• Static/Dynamic Application Security Testing (SAST/DAST)


• System Hardening Standards


• Cybersecurity Requirements Embedding


• Technical Scan Data Evaluation


• Zero-Trust Alignment

Soft Skills

• Collaboration


• Negotiation


• Advisory Skills


• Communication

Certifications & Qualifications

• CompTIA Security+


• CISSP


• CISM


• GSEC


• Cloud+

Industry Keywords

• Cybersecurity


• DoDI


• Navy


• Army


• Compliance


• Authorization to Operate (ATO)


• Risk Management


• Government Inspections


• Security Posture


• Mission Risk Trade-offs

Tools & Technologies

• EMASS


• ACAS


• Nessus


• SCAP Compliance Checker


• DISA STIGs


• CIS Benchmarks