Cybersecurity Information System Security Manager

Anduril Industries, Inc.; Irvine (CA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Equity grants

Health, dental & vision benefits

Retirement plan

Job summary

Anduril Industries, Inc. is seeking a Cybersecurity Information System Security Manager (ISSM) to own the cyber compliance posture for its command and control software systems.

You will drive the end-to-end RMF/ eMASS process, develop artifacts, and enforce security procedures across development and operations, collaborating with engineers and government stakeholders in a fast-paced environment.

Qualifications

• 5+ years as ISSO or equivalent cybersecurity role.
• 3+ years hands-on with eMASS including artifact creation/submission.
• Experience delivering RMF packages through ATO.
• Solid knowledge of NIST SP 800-53, 800-37, and DoD policies.
• Experience with STIG checklists across OS, apps, and networks.
• Experience with vulnerability/code analysis tools (Nessus/ACAS/SonarQube/Fortify).
• Bachelor's degree in CS/Cybersecurity or related field.

Responsibilities

• Own cyber compliance posture for C2 software systems.
• Lead eMASS artifacts, SSPs, SARs, and ATO materials.
• Enforce RMF requirements and continuous monitoring activities.
• Coordinate with engineers and government Stakeholders throughout accreditation.
• Integrate security controls into CI/CD pipelines.

Skills

RMF & NIST Standards

Cybersecurity Program Leadership

Vulnerability Management

eMASS Proficiency

POAM Management

DoD Security Knowledge

Security Controls in CI/CD

Education

Bachelor's degree in CS/Cybersecurity

Tools

Nessus

ACAS

SonarQube

Fortify

STIGs

eMASS Actions/Artifacts

Job description

Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years.

ABOUT THE TEAM

The Air Defense team builds robots that find other robots and knock them out of the sky. At a time when air superiority can no longer be taken for granted, the Air Defense team provides mission critical capabilities to warfighters. From detection to tracking, identification, deterrence, and defeat, our family of networked sensors and effectors enables our customers to rapidly close the kill chain against a broad range of UAS threats. Working across product, engineering, business development, logistics, operations, and mission success, the Air Defense team develops, tests, deploys, and sustains the Anduril Air Defense Family of Systems in challenging operational environments worldwide.

ABOUT THE JOB

Anduril's Air Defense division is seeking a Cybersecurity Information System Security Manager (ISSM) to own the cyber compliance posture of our command and control (C2) software systems. This role sits at the intersection of mission-critical software delivery and government cybersecurity accreditation — you will be responsible for building and maintaining the full cybersecurity authorization lifecycle, from policy development through artifact delivery, ensuring our systems meet the rigorous security standards required for Department of Defense deployment.
You will serve as the primary cybersecurity authority for your program, driving the end-to-end Enterprise Mission Assurance Support Service (eMASS) accreditation process, enforcing security standard operating procedures, managing Plans of Action and Milestones (POAMs), and ensuring continuous compliance across development and operational environments. This is not a checkbox role — you will work directly with engineers, program managers, and government stakeholders to embed security into the development lifecycle while keeping pace with rapid software delivery.

WHAT YOU'LL DO

• Lead the development, submission, and management of all government cybersecurity authorization artifacts within eMASS, including System Security Plans (SSPs), Security Assessment Reports (SARs), and supporting documentation required for Authority to Operate (ATO)
• Serve as the program Information System Security Manager (ISSM), maintaining continuous monitoring activities and ensuring compliance with Risk Management Framework (RMF) requirements
• Develop, implement, and enforce cybersecurity standard operating procedures across the program, ensuring engineering teams adhere to security policies throughout the software development lifecycle
• Pull, tailor, and validate Security Technical Implementation Guides (STIGs) applicable to program systems, coordinating remediation efforts with development teams
• Manage and execute application and infrastructure code scans, triaging findings and coordinating remediation with engineering
• Create, track, and manage Plans of Action and Milestones (POAMs), including risk assessments, mitigation strategies, and closure activities
• Advise program leadership on cybersecurity risk posture, emerging threats, and compliance status
• Interface directly with government cybersecurity stakeholders, Authorizing Officials (AOs), and Security Control Assessors (SCAs) throughout the accreditation lifecycle
• Collaborate with software engineers to integrate security controls into continuous integration and continuous delivery (CI/CD) pipelines

REQUIRED QUALIFICATIONS

• United States citizenship with an active Secret or Top Secret security clearance
• Minimum 5 years of experience serving as an Information System Security Officer (ISSO) or in an equivalent cybersecurity compliance role
• Minimum 3 years of hands‑on experience with eMASS, including artifact creation, submission, and package management
• Demonstrated experience delivering complete RMF authorization packages through to ATO
• Strong working knowledge of NIST Special Publication 800-53, NIST 800-37, and DoD cybersecurity policies (DoDI 8510.01)
• Experience pulling, applying, and validating STIG checklists across operating systems, applications, and network devices
• Experience with vulnerability scanning and code analysis tools (for example, Nessus, ACAS, SonarQube, Fortify, or equivalent)
• Proficiency in POAM creation, management, and closure processes
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related technical discipline

PREFERRED QUALIFICATIONS

• Experience with networking, communications systems, or command and control architectures
• DoD 8570/8140 certification (for example, Security+, CISSP, CISM, CAP, or equivalent)
• Experience supporting software-intensive programs with agile or DevSecOps development methodologies
• Familiarity with container security, cloud security architectures, or zero-trust frameworks
• Prior experience supporting air defense, missile defense, or integrated battle command systems
• Experience working with cross-functional engineering teams in a fast‑paced, iterative development environment
• Experience with red team, blue team, or penetration testing methodologies

The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top‑tier benefits for full‑time employees, including:

Benefits

At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits.

Protecting Yourself from Recruitment Scams

Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information.

To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind:

• No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates.

• Please always verify communications:
  • Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an @anduril.com address.
  • Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to [e-mail].

• Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links.

• What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to [e-mail]. Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts.

Data Privacy

To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/.

By submitting your application, you consent to Anduril Industries using a third‑party service provider to conduct pre‑employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third‑party service provider provides risk‑intelligence services that may include analysis of sanctions and watchlists, adverse media, public‑record information, and other lawful open‑source or commercial data sources. This third‑party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.