Information System Security Manager

Cape Fox Shared Services; Texas; On-site; USD 135,000 - 155,000; Full time

Benefits offered by this job

Company holidays

Paid time off

Health insurance

Dental insurance

Vision insurance

Life and disability insurance

Tuition reimbursement

401K with company match

Job summary

Cape Fox Federal Integrators is seeking an Information System Security Manager (ISSM) to oversee cybersecurity for NIPRNet, DREN, RDTE, SIPRNet, and standalone systems for a federal client. The role ensures RMF compliance, maintains ATOs, and administers privileged access while coordinating audits and security posture.

The position offers a salary range of $135,000–$155,000 with comprehensive benefits, and is contingent on contract award.

Qualifications

• Requires strong RMF knowledge and DoD cybersecurity standards.
• Experience validating DoD 8570.01-M/8140 certifications.
• Ability to manage privileged access and conduct security audits.

Responsibilities

• Provide ISSM cybersecurity support for DoD networks and enclaves.
• Maintain RMF compliance, ATOs, and documentation across TSRL/related subsystems.
• Coordinate with stakeholders for threat assessments, remediation, and audits.

Skills

RMF compliance

NIPRNet/DREN/SIPRNet

Privileged access management

Cybersecurity audits

DoD 8570.01-M / DoDI 8140

Tools

eMASS

ACAS

STIGs

Job description

Cape Fox subsidiary, Cape Fox Federal Integrators (CFFI), is seeking a highly qualified and motivated Information System Security Manager (ISSM) to provide cybersecurity support for Non-classified Internet Protocol Router Network (NIPRNet), Defense Research and Engineering Network (DREN), Research, Development, Test, and Evaluation (RDTE), Secret Internet Protocol Router Network (SIPRNet), and standalone systems and enclaves for a federal government client. The ISSM will oversee cybersecurity compliance, Risk Management Framework (RMF) requirements, personnel certification and training verification, privileged access management, and security audits in accordance with applicable DoD policies and directives. This position is contingent upon contract award.

The salary range (or hiring range) for this exempt position is: $135,000-$155,000

The above salary range represents the company's good faith and reasonable estimate of the range of possible compensation at the time of posting. In addition, we offer a variety of benefits, including company holidays, paid time off, health insurance, dental insurance, vision insurance, life and disability insurance, tuition reimbursement, as well as a 401K with company match. This job will be posted until filled or withdrawn.

Core Duties

• Provide ISSM cybersecurity support for NIPRNet, DREN, RDTE, SIPRNet, and standalone enclaves/systems
• Perform the Information System Security Manager (ISSM), 8140 Cyberwarfare Code of 722 duties to include formally validating and verifying that all administrative and technical personnel meet the mandatory baseline certification and training requirements of DoD 8570.01-M / DoDI 8140 prior to granting elevated system access; administering and maintaining signed Privileged Access Agreements (PAAs); and conducting recurring audits of all privileged accounts
• Cybersecurity Consultation: Advise unit technicians on cybersecurity requirements, solutions, and implementation
• Enterprise Cybersecurity Compliance: Administer, coordinate, and track compliance with TSRL enterprise cybersecurity architecture, strategy, plans, and policies across the distributed organization
• RMF and ATO Management: Ensure Risk Management Framework (RMF) compliance, maintain valid Authority to Operate (ATO), keep security documentation current, and provide cybersecurity expertise to supported units
• Configuration Management: Review configuration management processes, maintain secure mechanisms, update RMF requirements, and support internal and external audits and inspections
• IT Portfolio and Database Management: Maintain Information Technology (IT) portfolio data and database structures in the Information Technology Investment Portfolio System (ITIPS), RMF Workflow, and Enterprise Mission Assurance Support Service (eMASS)
• Security Standards and Authorization: Maintain Authority to Operates (ATOs) for TSRL and related subsystems in accordance with NIST SP 800-53 Rev. 5, CNSSI 1253 Rev. 4, DoDI 8510.01, DISAI 270-50-9, and applicable RMF directives
• Risk Advisory and Reporting: Advise senior management and the Authorizing Official on risk levels, security posture, and changes affecting organizational cybersecurity
• Threat and Vulnerability Assessments: Assess system and enclave threats, vulnerabilities, and technical risks; document findings and recommend mitigation measures
• Cybersecurity Reporting and Repository Management: Collect and maintain cybersecurity reporting data and manage the digital eMASS system package repository on authorized information systems
• eMASS Administration: Track systems and enclaves in eMASS, maintain current ATOs, and manage security controls and assessment procedures in coordination with the TSRL IT lead while preventing accidental overwriting of other team members' data
• Security Documentation and SOPs: Develop, distribute, and maintain security plans, instructions, SOPs, Body of Evidence documents, System Security Plans, Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), risk assessments, topology diagrams, and hardware/software inventories
• Remediation Management: Establish and track remediation plans for vulnerabilities identified through risk assessments, audits, and inspections
• ATO Artifact Maintenance: Maintain ATO/eMASS artifacts for semiannual inspection and upload changes to required ATO documentation into eMASS within three business days
• System Hardening: Maintain Security Technical Implementation Guide (STIG) checklists and implement documented remediation actions for audit and inspection findings
• Cybersecurity Audits and Inspections: Support internal and external Government cybersecurity audits, inspections, and assessments
• Vulnerability Scanning: Use Assured Compliance Assessment Solution (ACAS) or other Air Force-approved scanning tools to evaluate scan results and identify vulnerabilities
• Application Security: Conduct application vulnerability assessments and technical and nontechnical risk assessments across relevant technologies, applications, and software
• IAVM Compliance: Implement Information Assurance Vulnerability Management (IAVM) dissemination, reporting, and compliance procedures
• Cloud Security and User Training: Apply cybersecurity strategies to cloud service and deployment models and ensure TSRL users complete required cybersecurity training for continued network access
• Logical Access Management: Maintain onboarding and offboarding SOPs, manage DD Form 2875 submission and routing, and coordinate organizational user accounts
• Media Destruction: Schedule and complete quarterly media destruction in accordance with Air Force and local policies
• Cybersecurity Meetings: Attend required in-person or virtual cybersecurity meetings and document meeting minutes supporting RMF requirements
• System Discovery and Compliance Engineering: Support system discovery, categorize systems for eMASS entry, develop compliant cybersecurity solutions and organizational security policies, and assist with hardware and software entry/exit requirements
• Agreements and Classified Equipment: Maintain TSRL Memorandums of Agreement (MOAs), Memorandums of Understanding (MOUs), and Acknowledgment of Responsibility (AOR) letters; update them annually and conduct full reviews every three years. Transport classified equipment and media to approved TSRL destinations in accordance with applicable security regulations
• Workforce Development

• DoD 8140.03 Compliance: Track and report certification requirements for applicable TSRL personnel
• Workforce Coordination: Participate in DoD 8140.03 teleconferences and meetings as required
• Metrics and Briefings: Coordinate with the Government lead to develop compliance metrics and briefings

Cybersecurity Working Group

• CSWG Participation: Support the Cybersecurity Working Group (CSWG) and participate in monthly video teleconferences.
• Meeting Administration: Conduct roll calls, record meeting minutes, track action items, and facilitate projects
• Requirements and Documentation: Gather requirements and help develop processes, concepts of operations, implementation standards, and cybersecurity policies
• Leadership Briefings: Brief DoD, Joint, Air Force, AFRL, and industry senior leaders on science and technology (S&T) IT and cybersecurity initiatives and recommendations

Customer Service

• User Support: Respond to user questions regarding cybersecurity and related technical topics
• Policy Interpretation: Explain cybersecurity processes, policies, and applicable requirements.
• Technical Guidance: Provide recommendations on secure cybersecurity configurations and implementation

Inspector General (IG)

• Inspection Support: Support the Inspection Functional Lead (IFL) for the Communications functional area during pre-inspection and post-inspection activities

Enterprise Pilot Project

• Pilot Project Support: Support research, selection, implementation, and operation of IT pilot and exploratory projects with enterprise-wide applicability
• Technology Evaluation: Support initiatives involving cybersecurity, server and desktop virtualization, collaborative systems, multiplatform research computing, mobile technologies, automated IT systems management, and public, private, and hybrid cloud services
• Performance Measurement: Collect metrics and prepare reports assessing project outcomes, efficiency, capability improvements, and cybersecurity benefits