Information Systems Security Manager

Second Front Systems; United States; Remote; USD 170,000 - 180,000; Full time

Benefits offered by this job

Competitive salary

Employer-paid medical/dental/vision

401(k) with company contribution

Wellness benefits and One Medical

Equity incentive plan

Home office stipend

Professional development stipend

Flexible paid time off + federalHol

Parental leave

Flexible remote work opportunities

Employee referral bonus

Job summary

Second Front Systems is seeking an Information Systems Security Manager (ISSM) + Privacy to strengthen our cybersecurity and authorization functions for a defense software platform. You will own RMF authorization, risk posture, privacy compliance, and monitoring across a portfolio.

The role requires DoD RMF expertise, privacy controls, and the ability to lead ISSO teams, author PTAs and PIAs, map PII/CUI flows, and brief senior leaders. Candidates must reside in approved hubs; U.S.

Qualifications

• 7+ years of hands-on DoD cybersecurity, RMF authorization, or information assurance experience, including ISSM/lead ISSO roles.
• 3+ years of federal or DoD privacy experience, including PTAs and PIAs.
• Experience managing authorization packages in eMASS and at least one other GRC tool (Xacta/RegScale/CSAM).
• Ability to direct, mentor, and quality-review ISSOs and compliance staff.
• Strong knowledge of NIST 800-53 Rev 4/5, RMF, CNSSI 1253 privacy overlays, and DoD guidance.
• Cloud literacy (AWS, containers, Kubernetes, CI/CD) and mapping to security/privacy controls.
• Active U.S. Secret clearance; DoD IAM 8570/8140 Level II and privacy certifications or ability to obtain.
• Excellent communication to briefing leaders on risk and compliance.

Responsibilities

• Own authorization status, risk posture, privacy compliance, and continuous monitoring health across a system portfolio.
• Orchestrate RMF workflows in eMASS and other GRC tools from categorization to continuous monitoring.
• Direct and mentor ISSOs, review packages for quality, and coach on security and privacy requirements.
• Govern privacy authorization, drafting PTAs, PIAs, SORN determinations, and implement privacy controls.
• Map PII/CUI data flows with ISSEs to ensure documentation in authorization packages.
• Assess residual risk and make risk acceptance and POA&M recommendations to leadership.
• Maintain breach response procedures aligned with DoD requirements.
• Create repeatable privacy templates, training materials, and workflows for the team.

Skills

DoD cybersecurity

RMF authorization

information assurance

privacy compliance

leadership

communication

Tools

eMASS

Xacta

RegScale

CSAM

Job description

Information Systems Security Manager (ISSM) + Privacy

Second Front Systems is looking for a mission-focused, privacy-expert, decisive Information Systems Security Manager (ISSM) + Privacy to strengthen our cybersecurity and authorization function. Operating at the RMF and continuous monitoring cadence for a defense software platform and its customer systems, you will be responsible for owning authorization status, risk posture, privacy compliance, and continuous monitoring across an assigned system portfolio. You will manage concurrent RMF workflows in eMASS and other GRC tools, lead privacy authorization work, and serve as primary government interface, ensuring that all systems maintain valid ATOs, privacy controls meet DoD and federal requirements, and residual risk is visible to leadership and Authorizing Officials. We need someone capable of directing ISSO teams and quality‑review authorization packages for completeness and rigor; authoring Privacy Threshold Analyses, Privacy Impact Assessments, and SORN determinations under the Privacy Act, OMB Circular A-130, and DoD 5400.11-R; and mapping PII and CUI data flows across cloud-native systems and recommending practical privacy controls aligned with NIST 800-53 Rev 5 and CNSSI 1253 privacy overlays. As a key partner to Authorizing Officials, Security Control Assessors, DoD privacy officers, and customer security teams, you will brief risk and authorization status, elevate material risks, and maintain readiness for assessments and reciprocity decisions, serving as the authoritative voice on how PII is protected and authorized across the company's DoD environment. This is a full‑time position.

Note

Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

What You’ll Do

• Own authorization status, risk posture, privacy compliance, and continuous monitoring health across an assigned system portfolio.
• Orchestrate concurrent RMF workflows in eMASS and other GRC tools (Xacta, RegScale, CSAM) from categorization through continuous monitoring.
• Direct and mentor ISSOs supporting the portfolio, assign work, review authorization packages for quality, and coach on security and privacy requirements.
• Govern privacy authorization across all systems, authoring PTAs, PIAs, SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls and CNSSI 1253 overlays.
• Synchronize PII and CUI data flows with ISSEs and Solutions Architects to ensure accurate identification and documentation in authorization packages and system designs.
• Assess residual security and privacy risk across the portfolio, make risk acceptance and POA&M recommendations, and elevate material risks to leadership and Authorizing Officials.
• Mitigate breach response risk by maintaining incident and breach‑response procedures aligned with OMB M-17-12 and DoD requirements.
• Establish repeatable privacy templates, training materials, and authorization workflows for the wider team, and report privacy posture trends to leadership.

What You Bring

• 7+ years of hands‑on DoD cybersecurity, RMF authorization, or information assurance experience, with at least 3 years serving as ISSM, lead ISSO, or equivalent role accountable for multiple ATO packages.
• 3+ years of direct federal or DoD privacy experience, including authoring PTAs and PIAs, making SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls under the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.
• Expert hands‑on experience managing authorization packages in eMASS plus mastery of at least one additional GRC tool (Xacta, RegScale, or CSAM).
• Demonstrated ability to direct, mentor, and quality‑review the work of ISSOs or compliance staff, with proven track record managing multiple concurrent authorization efforts.
• Expert knowledge of NIST 800-53 (Rev 4 and 5), NIST 800-37 RMF, CNSSI 1253 including privacy overlays, and DoD‑specific implementation guidance.
• Solid technical literacy in cloud environments (AWS, containers, Kubernetes, CI/CD) and ability to map cloud‑native patterns to technical security and privacy controls.
• Active U.S. Secret security clearance; DoD 8570/8140 IAM Level II baseline certification (CISSP, CISM, or CASP+) or ability to obtain within 90 days; IAPP privacy certification (CIPP/G, CIPP/US, CIPM, or CIPT) or ability to obtain within 6 months.
• Strong written and verbal communication skills, including ability to brief Authorizing Officials, privacy officers, and senior leaders on risk, authorization status, and compliance posture.
• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $170,000 - $180,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset.
• Viewing obstacles as opportunities for growth.
• Having a bias toward action and tangible, measurable results.
• Being team-oriented with a focus on personal responsibility and autonomy.

Perks & Benefits:

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

Perks of Joining Our Team:

• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Visit our careers page to learn more.

Who We Are:

Second Front Systems (2F) is a public‑benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top‑tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement:

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing:

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

State notices:

Colorado:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.