Information System Security Manager (ISSM)

3M HEALTHCARE; Alexandria (VA); Hybrid; USD 145,000 - 190,000; Full time

Benefits offered by this job

Travel allowance

Job summary

KBR is seeking an Information System Security Manager (ISSM) to join our team in the Virginia, Maryland, or Washington, DC area. The role is primarily remote; however, the ISSM must reside in the area and be able to travel into the DoD installation space for meetings and work as needed.

Responsibilities include RMF package development, executive briefings, audits, and liaison with SISO, PM, and AO. Travel up to 25% is required; strong expertise in NIST SP 800-series and TS/SCI clearance are

Qualifications

• TS/SCI clearance required.
• Minimum 2 years IT/IA/cybersecurity engineering experience.
• Experience guiding RMF processes with ISSO/ISSM.
• Bachelor’s degree or 8 years IT experience in lieu; Master’s preferred.
• Proven knowledge of NIST 800-53 and security development.
• Strong communication with senior leadership.

Responsibilities

• Deliver RMF documentation, executive briefings, and RMF packages.
• Review ACAS/HBSS reports for compliance and reporting.
• Lead RMF package development and ATO status updates.
• Collaborate with SISO, PM, and AO; support security engineering projects.
• Lead security audits and remediation of vulnerabilities.
• Prepare monthly security metrics and executive briefings.
• Travel 25% and interface with distributed teams.

Skills

RMF packages

Information Assurance

Security Audits

Executive communication

NIST SP 800-series

Education

Bachelor’s degree in Engineering, Computer Science, or 8 years IT field experience in lieu of degree

Master’s degree preferred

Tools

ACAS

HBSS

NIST SP 800-series

Job description

Information System Security Manager (ISSM) – KBR is seeking an Information System Security Manager (ISSM) to join our team in either Virginia, Maryland, or Washington, DC. This position is primarily remote; however, the ISSM must reside in the area of the position and be able to travel into the DoD installation space for meetings and work ad‑hoc and sometimes immediately.

Responsibilities

• Deliver documentation to include: Executive level briefings, assessments, self‑assessments, RMF packages, and supporting RMF documentation.
• Review cybersecurity tool reports, ACAS, HBSS, for the purposes of reporting and compliance.
• Software certification package development.
• Work directly with the TRMC SISO on all TRMC RMF packages and ATO status updates.
• Support security engineering projects and solution delivery.
• Lead security audit and compliance activities for each system.
• Audit all artifacts provided in each RMF package to determine system readiness for ATO packet submissions.
• Provide recommendations to the SISO, PM, and AO regarding remediation and mitigation of identified vulnerabilities on test reports and plans of action and milestones (POA&Ms).
• Monitor system status updates and report to senior leadership.
• Include monthly executive reports, vulnerability reports, JFHQ DODIN reporting and briefing.
• Provide monthly executive briefing to SISO, PM on security metrics.
• Interface with PMs and SISO on issues needing input or concurrence.
• Draft and present RMF deliverables to senior leadership.
• Attend Executive Program Reviews as the ISSM.
• Work with outside agencies on memorandums of understanding/interconnection service agreements and other senior‑level agreements, etc.
• Work directly with a distributed team to reduce travel.
• Travel 25% of time.

Basic Qualifications

• TS/SCI required.
• Minimum of 2 years of Information Technology, Information Assurance, or Cyber Security engineering experience.
• Minimum of 2 years of experience in conducting security assessments by reviewing security controls with the ISSO/ISSM and guiding programs through the RMF process.
• Bachelor’s degree in Engineering, Computer Science, or 8 years IT field experience in lieu of degree; Master’s degree preferred.
• Proven expertise with assessing security controls in accordance with NIST Special Publications (i.e., NIST 800 Series).
• Proven in‑depth knowledge of cybersecurity principles, technologies, and processes.
• Experience with NIST 800‑53 and security development.
• Familiarity with performing assessments for unclassified and classified environments.
• Ability to adapt to process changes.
• Ability to interface with senior leadership.
• Ability to support high‑visibility or high‑priority projects.
• Possession of excellent oral and written communication skills.

Basic Compensation

$145,000 to $180,000 – Salary range for Maryland. $150,000 to $190,000 – Salary range for DC. The offered rate will be based on the selected candidate’s knowledge, skills, abilities, and/or experience and in consideration of internal parity.

All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.