Information System Security Manager

Bering-Alaka`ina Holdings, LLC; San Antonio (TX); On-site; USD 110,000 - 150,000; Full time

Job summary

Bering-Alaka`ina Holdings, LLC seeks an Information System Security Manager (ISSM) to provide cybersecurity leadership for a government customer in San Antonio, TX. The ISSM will validate training, manage privileged access, and ensure RMF/ATO compliance across multiple enclaves and systems.

The role requires five years of RMF experience, active Security+ certification, and a SECRET clearance. You will work with eMASS, ITIPS, and other RMF tooling to sustain authorization to operate and support

Qualifications

• Five+ years of RMF work experience with minimal lapse in cyberspace duties.
• Active Security+ certification and ability to sign NDA.
• Familiar with DoD 8140 and related cyber workforce requirements.

Responsibilities

• Provide ISSM cybersecurity support for DoD networks and enclaves.
• Validate baseline certifications and training for privileged access.
• Advise on risk, security posture, and RMF/ATO readiness.
• Maintain RMF artifacts, eMASS entries, and ACCAS/Audit artifacts.
• Lead and coordinate RMF activities across TSRL and subordinate units.
• Coordinate with IT leads on security controls and policy implementation.

Skills

RMF experience

Security+ certified

Non-disclosure agreement

DoD 8140 familiarity

Education

Bachelor of Science in IT or Cybersecurity

DoD 8140 certs (CASP+, CISSO, CCSP, SEC+)

Tools

RMF

eMASS

NIST 800-53

Job description

Bering-Alaka`ina Holdings, LLC has a potential need for an Information System Security Manager (ISSM) to provide support for our government customer in San Antonio, TX.

DESCRIPTION OF RESPONSIBILITIES

• Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems.

• Formally validating and verifying that all administrative and technical personnel meet the baseline certification and training requirements of DoD 8140 prior to granting elevated system access, administering and maintaining signed Privileged Access Agreements (PAAs); and conducting recurring audits of all privileged accounts.

• Serve as a cybersecurity consultant for unit technicians.
• Perform tasks necessary to administer, coordinate and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, and supplemental policy for the entire organization.
• Ensure Risk Management Framework (RMF) requirements are met, Authority to Operate (ATO) is granted and remains valid, all security-related documentation is kept up-to-date, and supported units have a reliable team of cybersecurity experts.
• Assist in configuration management process reviews and maintenance to ensure appropriate secure mechanisms are in place, update RMF requirements, and support internal and external entity audits and inspections.
• Perform data entry, monitoring, and provide assistance to maintain data and database organization structures within the IT portfolio in the Information Technology Investment Portfolio System (ITIPS), the RMF workflow and Enterprise Mission Assurance Support Service (eMASS) systems.
• Achieve and continuously maintain the Authorization to Operate (ATO) for TSRL, related subsystems; NIST 800-53, Rev 5, Security and Privacy Controls for Federal Information Systems and Organizations; Committee on National Security Systems Instruction No. 1253 (CNSSI 1253, Rev 4), Security Categorization and Control Selection for National Security Systems; DODI 8510.01, Risk Management Framework for DoD Systems; and DISAI 270-50-9, Life Cycle Sustainment Planning, among other risk management framework directives.
• Advise senior management and Authorizing Official on risk levels, security posture, and changes affecting the organization’s cybersecurity posture.
• Assess threats to and vulnerabilities of computer systems/enclaves to develop a security risk profile. Shall conduct technical risk assessments to identify, document, and mitigate vulnerabilities across computer systems and enclaves.
• Collect and maintain data needed to meet system/enclave cybersecurity reporting. Shall maintain a digital eMASS system package repository on the authorized Information System (IS).
• Administer and track all relevant systems/enclaves within Enterprise Mission Assurance Support Service (eMASS) and ensure the ATO is current.
• Prepare, distribute, and maintain plans, instructions, and standard operating procedures (SOPs) concerning system security, for example; Body of Evidence documents, System Security Plans, Security Assessment Reports (SAR), Plan of Actions and Milestones (POAM), risk assessment reports, topology diagrams, software lists, and hardware list.
• Ensure plans of action and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.
• Maintain artifacts specified within the ATO/eMASS package such that they can be inspected semi-annually and any changes to ATO required documentation must be uploaded as an artifact in eMASS within three (3) business days.
• Maintain system hardening checklists (STIGs) and implement documented remediation plans (fix-actions) to resolve findings from official cybersecurity audits and inspections.
• Support cybersecurity inspections and audits by internal and external Government agencies, as necessary.
• Coordinate with the TSRL IT lead to implement changes within eMASS; implement, assess, manage, and monitor eMASS security controls and eMASS assessment procedures (APs); shall ensure precautions are in place such that other team members’ eMASS data is not erroneously overwritten.
• Utilize Assured Compliance Assessment Solution (ACAS), or other AF-approved scanning software, to accomplish audit controls and interpret vulnerability scanner results to identify vulnerabilities.
• Conduct application vulnerability assessments and perform technical and non-technical risk and vulnerability assessments of relevant technology focus areas to include applications/software.
• Ensure implementation of Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance procedures.
• Apply cybersecurity strategy to cloud computing service and deployment models.
• Perform applicable training and ensure cybersecurity training requirements have been satisfied by all TSRL users for continued network access.
• Execute logical system access onboarding and offboarding programs, for example maintaining up-to-date Standard Operating Procedures (SOPs) for the submission and routing of DD Form 2875s, and serving as the central coordinator for all organizational accounts.
• Schedule and complete quarterly destruction of media in accordance with AF and local policies.
• Attend in-person or virtual cybersecurity-related meetings, as required, and provide meeting minutes to support RMF requirements.
• Collaborate in system discovery and unit discussions to categorize systems for entry into eMASS, engineer compliant cybersecurity solutions, and develop organizational security policies. Shall assist with all hardware and software entry/exit requirements pertaining to TSRL, as dictated by policy.
• Assist with managing all TSRL Memorandums of Agreement (MOA), Memorandums of Understanding (MOU), and Acknowledgement of Responsibility (AOR) Letters between the division and external customers for the RMF Accreditation Program. Shall assist in updating these documents annually and conduct complete reviews every three (3) years. Shall courier classified equipment or media to approved destinations throughout TSRL in accordance with applicable security regulations.
• Other duties as assigned by Supervisor.

REQUIRED DEGREE/EDUCATION/CERTIFICATION

• Bachelor of Science Degree in Information Technology or Cybersecurity.
• Must meet all required certifications for DoD 8140. (CASP+; CISSO; CCSP; SEC+)

REQUIRED SKILLS AND EXPERIENCE

• Minimum of five (5) years of experience working Risk Management Framework (RMF) requirements and providing cybersecurity services with no more than 3 consecutive years of lapse in cyberspace work.
• Must have a Security + certification that is valid.
• Must be willing to sign a non-disclosure agreement.

REQUIRED CITIZENSHIP AND CLEARANCE

• Must be a naturalized United States Citizen. Green Card and VISA holders are not eligible.
• Must have an active SECRET clearance.

Bering-Alaka`ina Holdings, LLC is a fast-growing government service provider. Employees enjoy competitive salaries. Eligible employees enjoy a 401K plan with company match; medical, dental, disability, and life insurance coverage; tuition reimbursement; paid time off; and 11 paid holidays.

We are an Equal Opportunity/Affirmative Action Employer of individuals with disabilities and veterans. We not illegally discriminate in employment decisions on the basis of any protected categories. If you are a person with a disability and you need an accommodation during the application process, please clickhere to request accommodation. We E-Verify all employees.

As a part of BSNC, Bering- Alakaina Holdings gives hiring, promotion, training, and retention preference to BSNC shareholders, descendants and shareholder spouses who meet the minimum qualifications for the job. Qualified job candidates will generally be considered in the following order: BSNC shareholders, descendants, shareholder spouses, current employees, and outside candidates. The BSNC Shareholder Development department tracks and monitors the implementation of the Shareholder Hire Preference across its operations.

Bering-Alaka`ina Holdings, LLC is comprised of industry-recognized government service firms designated as Alaska Native Corporation (ACN)-owned and 8(a) certified businesses and includes Ke`aki Technologies, LLC; Laulima Government Solutions, LLC; Kūpono Government Services, LLC; Kapili Services, LLC; Po`okela Solutions, LLC; Kīkaha Solutions, LLC;and Pololei Solutions, LLC.

For additional information, please visit www.beringalakaina.com

#LI-JS1

#ClearanceJobs