Information System Security Manager

Cape Fox Corp

San Antonio (TX)

On-site

USD 120,000 - 180,000

Full time

3 hours ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Company holidays

Paid time off

Health insurance

Dental insurance

Vision insurance

Life and disability insurance

Tuition reimbursement

401K with company match

Job summary

Cape Fox Corp, through its Cape Fox Federal Integrators (CFFI) unit, seeks an experienced Information System Security Manager to oversee RMF compliance, ATO maintenance, and DoD 8140.03-aligned cybersecurity operations for NIPRNet, SIPRNet, DREN, RDTE, and standalone environments.

The ISSM will coordinate audits, training verification, and privileged access management, ensuring security controls and policy adherence across the enterprise. A Secret clearance and US work authorization are required.

Qualifications

Bachelor degree in IT or Cybersecurity required.
At least five years' RMF experience and cybersecurity services.
DoD 8140.03 education, training and certification requirements must be met.
Current Security+ certification and Secret Clearance required.
Authorized to work in the United States.

Responsibilities

Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems.
Maintain RMF compliance and Authority to Operate (ATO) documentation.
Lead cybersecurity audits and inspections and coordinate with TSRL leadership.
Advise leadership on risk levels and security posture.

Skills

RMF experience

Cybersecurity services

Security best practices

Education

Bachelor of Science in Information Technology or Cybersecurity

Security+ certification

Job description

Information System Security Manager - (9146)

Share this job as a link in your status update to LinkedIn.

Job Title

Information System Security Manager

Job Description

Cape Fox subsidiary, Cape Fox Federal Integrators (CFFI), is seeking a highly qualified and motivated Information System Security Manager (ISSM) to provide cybersecurity support for Non-classified Internet Protocol Router Network (NIPRNet), Defense Research and Engineering Network (DREN), Research, Development, Test, and Evaluation (RDTE), Secret Internet Protocol Router Network (SIPRNet), and standalone systems and enclaves for a federal government client. The ISSM will oversee cybersecurity compliance, Risk Management Framework (RMF) requirements, personnel certification and training verification, privileged access management, and security audits in accordance with applicable DoD policies and directives. This position is contingent upon contract award.

The above salary range represents the company’s good faith and reasonable estimate of the range of possible compensation at the time of posting. In addition, we offer a variety of benefits, including company holidays, paid time off, health insurance, dental insurance, vision insurance, life and disability insurance, tuition reimbursement, as well as a 401K with company match. This job will be posted until filled or withdrawn.

Core Duties

Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems
Perform the Information System Security Manager (ISSM), 8140 Cyberwarfare Code of 722 duties to include formally validating and verifying that all administrative and technical personnel meet the mandatory baseline certification and training requirements of DoD 8570.01-M / DoDI 8140 prior to granting elevated system access; administering and maintaining signed Privileged Access Agreements (PAAs); and conducting recurring audits of all privileged accounts
Cybersecurity Consultation: Advise unit technicians on cybersecurity requirements, solutions, and implementation
Enterprise Cybersecurity Compliance: Administer, coordinate, and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, and policies across the distributed organization
RMF and ATO Management: Ensure Risk Management Framework (RMF) compliance, maintain valid Authority to Operate (ATO), keep security documentation current, and provide cybersecurity expertise to supported units
Configuration Management: Review configuration management processes, maintain secure mechanisms, update RMF requirements, and support internal and external audits and inspections
IT Portfolio and Database Management: Maintain Information Technology (IT) portfolio data and database structures in the Information Technology Investment Portfolio System (ITIPS), RMF Workflow, and Enterprise Mission Assurance Support Service (eMASS)
Security Standards and Authorization: Maintain Authority to Operates (ATOs) for TSRL and related subsystems in accordance with NIST SP 800-53 Rev. 5, CNSSI 1253 Rev. 4, DoDI 8510.01, DISAI 270-50-9, and applicable RMF directives
Risk Advisory and Reporting: Advise senior management and the Authorizing Official on risk levels, security posture, and changes affecting organizational cybersecurity
Threat and Vulnerability Assessments: Assess system and enclave threats, vulnerabilities, and technical risks; document findings and recommend mitigation measures
Cybersecurity Reporting and Repository Management: Collect and maintain cybersecurity reporting data and manage the digital eMASS system package repository on authorized information systems
eMASS Administration: Track systems and enclaves in eMASS, maintain current ATOs, and manage security controls and assessment procedures in coordination with the TSRL IT lead while preventing accidental overwriting of other team members’ data
Security Documentation and SOPs: Develop, distribute, and maintain security plans, instructions, SOPs, Body of Evidence documents, System Security Plans, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), risk assessments, topology diagrams, and hardware/software inventories
Remediation Management: Establish and track remediation plans for vulnerabilities identified through risk assessments, audits, and inspections
ATO Artifact Maintenance: Maintain ATO/eMASS artifacts for semiannual inspection and upload changes to required ATO documentation into eMASS within three business days
System Hardening: Maintain Security Technical Implementation Guide (STIG) checklists and implement documented remediation actions for audit and inspection findings
Cybersecurity Audits and Inspections: Support internal and external Government cybersecurity audits, inspections, and assessments
Vulnerability Scanning: Use Assured Compliance Assessment Solution (ACAS) or other Air Force-approved scanning tools to evaluate scan results and identify vulnerabilities
Application Security: Conduct application vulnerability assessments and technical and nontechnical risk assessments across relevant technologies, applications, and software
IAVM Compliance: Implement Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance procedures
Cloud Security and User Training: Apply cybersecurity strategies to cloud service and deployment models and ensure TSRL users complete required cybersecurity training for continued network access
Logical Access Management: Maintain onboarding and offboarding SOPs, manage DD Form 2875 submission and routing, and coordinate organizational user accounts
Media Destruction: Schedule and complete quarterly media destruction in accordance with Air Force and local policies
Cybersecurity Meetings: Attend required in-person or virtual cybersecurity meetings and document meeting minutes supporting RMF requirements
System Discovery and Compliance Engineering: Support system discovery, categorize systems for eMASS entry, develop compliant cybersecurity solutions and organizational security policies, and assist with hardware and software entry/exit requirements
Agreements and Classified Equipment: Maintain TSRL Memorandums of Agreement (MOAs), Memorandums of Understanding (MOUs), and Acknowledgment of Responsibility (AOR) letters; update them annually and conduct full reviews every three years. Transport classified equipment and media to approved TSRL destinations in accordance with applicable security regulations
Workforce Development
DoD 8140.03 Compliance: Track and report certification requirements for applicable TSRL personnel
Workforce Coordination: Participate in DoD 8140.03 teleconferences and meetings as required
Metrics and Briefings: Coordinate with the Government lead to develop compliance metrics and briefings
Cybersecurity Working Group
CSWG Participation: Support the Cybersecurity Working Group (CSWG) and participate in monthly video teleconferences.
Meeting Administration: Conduct roll calls, record meeting minutes, track action items, and facilitate projects
Requirements and Documentation: Gather requirements and help develop processes, concepts of operations, implementation standards, and cybersecurity policies
Leadership Briefings: Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on science and technology (S&T) IT and cybersecurity initiatives and recommendations
Customer Service
User Support: Respond to user questions regarding cybersecurity and related technical topics
Policy Interpretation: Explain cybersecurity processes, policies, and applicable requirements.
Technical Guidance: Provide recommendations on secure cybersecurity configurations and implementation
Inspector General (IG)
Inspection Support: Support the Inspection Functional Lead (IFL) for the Communications functional area during pre-inspection and post-inspection activities
Pilot Project Support: Support research, selection, implementation, and operation of IT pilot and exploratory projects with enterprise-wide applicability
Technology Evaluation: Support initiatives involving cybersecurity, server and desktop virtualization, collaborative systems, multiplatform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services
Performance Measurement: Collect metrics and prepare reports assessing project outcomes, efficiency, capability improvements, and cybersecurity benefits

Travel Requirements

0 - 10%

Job Requirements

Requirements :

Must possess a Bachelor of Science degree in Information Technology or Cybersecurity, supported by a copy of the degree
Must have at least five years of experience with Risk Management Framework (RMF) requirements and cybersecurity services, with no more than three consecutive years of lapse in cyberspace work
Must meet applicable IT or Cybersecurity education, training, and certification requirements in accordance with DoDM 8140.03 and current Government directives, regulations, and policies for the assigned role or labor category (DFARS 252.239-7001)
Must have a current, valid Security+ certification
Must have Intermediate-level Cybersecurity Work Role experience
Must possess a current Secret Clearance
Must have authorization to work in the United States as defined by the Immigration Reform Act of 1986

Cape Fox Corporation, its subsidiaries, and affiliates provide equal employment opportunities to all persons and prohibit employment decisions on the basis of race, religion, color, creed, national origin, sex, age, disability, political affiliation, protected veteran status, or sexual orientation, or any other characteristic protected by federal, state, or local law. Cape Fox Corporation, its subsidiaries, and affiliates offer preference to Cape Fox Corporation Shareholders, descendants, and other Native Americans pursuant to Public Law 100-241.

#CJ