Information System Security Manager – ISSM

Jobtailor; Ventura (CA); On-site; USD 110,000 - 150,000; Full time

Job summary

Jobtailor is seeking an Information System Security Manager (ISSM) to serve as the primary cybersecurity authority for contractor networks and systems operating within Army and Navy program environments. The role is on-site, acting as a trusted advisor to government ISSMs and cybersecurity leadership, bridging contractor teams with accreditation authorities.

You will oversee ATO packaging in eMASS, evaluate DoD security controls, manage ConMon strategies, POA&Ms, and vulnerability remediation,

Qualifications

• Active TS clearance is required (TS/SCI preferred).
• DoD RMF lifecycle expertise with NIST SP 800-53 Rev.5.
• Experience building A&A packages for Navy/Army customers.
• Proven ability to coordinate with government stakeholders.
• Hands-on use of eMASS for A&A packaging.

Responsibilities

• Serve as on-site cybersecurity authority for Army/Navy program environments.
• Oversee ATO package creation and maintenance in eMASS.
• Evaluate DoD security controls and perform risk mitigation.
• Manage ConMon, POA&Ms, and vulnerability remediation.
• Coordinate with government ISSMs and internal teams during accreditation.
• Develop internal SOPs and secure development guidelines.

Skills

Collaboration

Negotiation

Advisory Skills

Communication

Risk Awareness

Education

Bachelor's degree in Information Technology / Cybersecurity / CS / IS / SWE

5+ years RMF experience

Tools

EMASS

ACAS

Nessus

SCAP Compliance Checker

DISA STIGs

CIS Benchmarks

Job description

• The Information System Security Manager (ISSM) serves as the primary cybersecurity authority and liaison for contractor-designed, built, and supported networks and systems operating within Army and Navy program environments.


• Operates on-site as a trusted advisor and peer to Government ISSMs and cybersecurity leadership, bridging the gap between contractor engineering teams and government accreditation authorities.


• Oversees the creation, defense, and maintenance of comprehensive ATO packages within key government repositories, primarily eMASS (Enterprise Mission Assurance Support Service) and Navy/Army-specific workflow databases.


• Evaluates contractor-designed architecture, software stacks, hardware configurations, and network topologies against DoD baseline security controls (NIST SP 800-53 R5, CNSSI 1253) to identify and mitigate risks early in the systems engineering lifecycle.


• Establishes robust Continuous Monitoring (ConMon) strategies, managing Plan of Action and Milestones (POA&Ms), vulnerability remediation (ACAS/Nessus scans, STIG compliance), and annual assessment reviews to prevent ATO expiration or authorization revocation.


• Serve as the primary contractor cybersecurity authority operating directly on-site with Navy Organization ISSMs, AODRs, and AOs to facilitate accreditation processes.


• Build, manage, and maintain formal Assessment & Authorization (A&A) packages within eMASS (Enterprise Mission Assurance Support Service) and relevant customer databases, ensuring accurate control allocation and implementation statements.


• Evaluate baseline security controls (NIST SP 800-53 Rev. 5, CNSSI 1253) across contractor-designed networks, verifying implementation of administrative, operational, and technical safeguards.


• Oversee automated vulnerability assessment tools (ACAS, Nessus, SCAP Compliance Checker), evaluating raw scan results, prioritizing findings, and ensuring required DISA STIGs/SRGs are applied.


• Draft, track, and remediate Plans of Action and Milestones (POA&Ms), negotiating acceptable risk levels and mitigation strategies with government stakeholders.


• Establish and execute ongoing ConMon strategies to maintain authorization boundaries, managing annual security reviews, boundary modification requests, and re-authorization events.


• Collaborate with internal software, network, and systems engineering teams during early development lifecycle phases to embed cybersecurity requirements into company-developed technology before deployment.


• Develop and enforce internal baseline configuration guides, utilizing DISA STIGs and CIS Benchmarks across company-built hardware appliances, software stacks, and operating environments.


• Evaluate internal product architectures and software deliverables for security posture, facilitating static/dynamic code analysis, dependency scanning, and zero-trust alignment.


• Establish company-internal cybersecurity standard operating procedures (SOPs), hardening checklists, and secure development guidelines to ensure consistency across product lines.


• Lead protective and corrective measures upon discovery of critical vulnerabilities or zero-day threats affecting deployed customer networks or company solutions.


• Coordinate with government security leadership and internal teams to report, contain, investigate, and remediate potential security incidents or policy non-compliance.


• Coordinate and prepare systems for formal government cybersecurity inspections, and internal quality audits.


• Advise internal engineering managers and government leadership on security posture, mission risk trade-offs, and emerging cybersecurity threats.


• Translate complex government compliance requirements (DoDI 8510.01, NIST guidelines) into actionable technical requirements for internal development teams.

Requirements

• Active TS clearance (TS/SCI preferred)


• DoD 8140/8570 Baseline Certification (Required): Intermediate Level (Minimum): CompTIA Security+, CompTIA SecurityX (formerly CASP+), Cloud+, GSEC, or equivalent


• Advanced Level (Preferred): CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), GCSA, GCIA, or CISSP-ISSMP.


• Bachelors in Information Technology, Cybersecurity, Computer Science, Information Systems, Software Engineering or equivalent +5 years of relevant experience supporting Army or Navy customers in the full RMF lifecycle.


• Government RMF & Compliance Mastery Demonstrated hands‑on experience navigating the complete Risk Management Framework (RMF) lifecycle per DoDI 8510.01, NIST SP 800-53 (Rev. 5), and CNSSI 1253.


• Advanced operational capability using eMASS (Enterprise Mission Assurance Support Service) to build, manage, and defend Assessment & Authorization (A&A) packages for Navy customers.


• Experience managing vulnerability assessment tools (ACAS/Nessus, SCAP Compliance Checker), evaluating raw technical scan data, and applying DISA STIGs / SRGs.


• Proven track record drafting, negotiating, and tracking POA&Ms through mitigation to secure ATO, ATO with Conditions, or Interim Authority to Test (IATT).


• Internal Product Hardening & DevSecOps Solid working knowledge of system hardening standards across operating systems (Linux/Windows), network infrastructure, containerized environments, and cloud architectures.


• Experience embedding cybersecurity requirements into early software/systems engineering workflows (Shift-Left Security / DevSecOps pipelines).


• Familiarity with static/dynamic application security testing (SAST/DAST) tools and software bill of materials (SBOM) management.


• Preferred / Desirable Qualifications Direct experience supporting Navy (NAVIFOR / NAVSEA / NAVAIR / SPAWAR) program offices and Authorizing Officials (AOs).


• Specialized certifications in audit, risk management, or cloud security (e.g., CISA, CRISC, CCSP, AWS/Azure Security Specialties).

Core Competencies

Demonstrates expertise in Cybersecurity Management, Risk Management Framework (RMF) lifecycle, and vulnerability assessment tools, with a strong focus on compliance with DoD standards and effective communication with government stakeholders.

Highest-signal resume keywords

• Active TS Clearance


• DoD 8140/8570 Baseline Certification


• Advanced Operational Capability Using eMASS


• Experience Managing Vulnerability Assessment Tools


• Internal Product Hardening & DevSecOps

ATS Optimization Keywords

Hard Skills

• Risk Management Framework (RMF)


• NIST SP 800-53


• Continuous Monitoring (ConMon)


• Assessment & Authorization (A&A)


• Vulnerability Remediation


• Static/Dynamic Application Security Testing (SAST/DAST)


• System Hardening Standards


• Cybersecurity Requirements Embedding


• Technical Scan Data Evaluation


• Zero-Trust Alignment

Soft Skills

• Collaboration


• Negotiation


• Advisory Skills


• Communication

Certifications & Qualifications

• CompTIA Security+


• CISSP


• CISM


• GSEC


• Cloud+

Industry Keywords

• Cybersecurity


• DoDI 8510.01


• Navy


• Army


• Compliance


• Authorization to Operate (ATO)


• Risk Management


• Government Inspections


• Security Posture


• Mission Risk Trade-offs

Tools & Technologies

• EMASS


• ACAS


• Nessus


• SCAP Compliance Checker


• DISA STIGs


• CIS Benchmarks