Information Systems Security Manager

Piper Companies; United States; Remote; USD 170,000 - 180,000; Full time

Benefits offered by this job

Annual bonus (10%)

Equity opportunities

Employer-paid medical benefits

Unlimited PTO

Paid federal holidays

Home-office stipend

Job summary

Zachary Piper Solutions seeks an Information Systems Security Manager (ISSM) to lead RMF execution, security authorization, and continuous monitoring across DoD and federal cloud environments. This role blends hands-on authorization leadership with privacy program execution, requiring expertise in eMASS, ATO packages, and NIST controls.

You will mentor ISSOs, coordinate with government stakeholders, and ensure privacy compliance while guiding risk decisions for complex systems and cloud

Qualifications

• 7+ years of hands-on DoD or federal cybersecurity and RMF experience.
• 3+ years as ISSM or Lead ISSO with multiple ATO packages.
• Demonstrated RMF execution, auth package development, and continuous monitoring.
• Hands-on eMASS experience with a GRC platform such as Xacta/RegScale/CSAM.
• DoD 8570 IAM Level II cert or ability to obtain within 90 days.
• Active Secret Clearance.
• IAPP privacy cert or ability to obtain within 6 months.
• Strong written and verbal communication skills for briefing leadership.

Responsibilities

• Lead DoD RMF activities and security authorization processes across systems and cloud environments.
• Manage multiple concurrent ATO/IATT and authorization packages throughout their lifecycle.
• Maintain accountability for SSPs, SARs, SCTMs, POA&Ms and supporting docs.
• Provide hands-on admin within eMASS and other GRC platforms.
• Lead continuous monitoring, vulnerability management, control assessments, risk analysis, remediation.
• Mentor ISSOs, review artifacts, and provide guidance across teams.

Skills

Strong comm.

RMF execution

Security authorization

eMASS

Privacy program

AWS GovCloud

Leadership

Education

DoD 8570/8140 IAM Level II

IAPP privacy cert (CIPP/G, US, CIPM, CIPT)

Tools

eMASS

Xacta

RegScale

CSAM

Job description

Zachary Piper Solutions is seeking an Information Systems Security Manager (ISSM) professional to support a federal and DOD cybersecurity mission. The ISSM will lead RMF execution, security authorization, continuous monitoring, and federal privacy compliance across secure cloud-native systems and environments. This position combines hands‑on cybersecurity authorization leadership with direct federal privacy program execution, requiring expertise in eMASS, ATO package management, NIST security and privacy controls, and AWS GovCloud. The ideal candidate will have experience leading ISSOs, managing multiple concurrent authorization packages, advising government stakeholders on risk and compliance, and implementing privacy requirements across federal information systems.

Responsibilities of the ISSM include:

• Lead and oversee DoD RMF activities and security authorization processes across multiple information systems and cloud-based environments.
• Manage multiple concurrent ATO, IATT, and authorization packages throughout their lifecycle
• Maintain accountability for security authorization packages, including SSPs, SARs, SCTM), POA&Ms, & supporting documentation
• Provide expert-level hands‑on administration and execution within eMASS & an additional GRC platform (Xacta, RegScale, CSAM)
• Lead continuous monitoring activities, vulnerability management, security control assessments, residual risk analysis, and remediation tracking.
• Oversee and mentor ISSOs, review authorization artifacts, ensure quality and consistency, and provide technical guidance across security teams.
• Coordinate with AOs, SCAs, government stakeholders, system owners, and engineering teams on authorization decisions and risk acceptance.
• Lead federal and DoD privacy compliance activities, including PTAs, PIAs, SORNs, & privacy determinations.
• Ensure compliance with the Privacy Act, OMB A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Rev. 5 privacy controls, and CNSSI 1253 privacy overlays.
• Integrate privacy requirements into RMF authorization packages, system design, control implementation, and continuous monitoring processes.
• Support AWS GovCloud security authorization and cloud compliance activities, including cloud-native architectures, containers, Kubernetes, and CI/CD environments.
• Assess security and privacy risks associated with system changes, cloud deployments, software releases, and new capabilities.
• Support SIAs, significant change reviews, incident response, and privacy breach response procedures.
• Brief government leadership and stakeholders on authorization status, cybersecurity risks, privacy compliance, remediation activities, and recommended risk mitigation strategies.

Qualifications of the ISSM include:

• 7+ years of hands‑on DoD or federal cybersecurity, Information Assurance (IA), and RMF experience.
• 3+ years serving as an ISSM or Lead ISSO with accountability for multiple ATO packages and security authorization lifecycles.
• Demonstrated experience leading RMF execution, authorization package development, continuous monitoring, and risk management across multiple systems.
• Expert-level hands‑on eMASS experience and working proficiency with an additional GRC platform such as Xacta, RegScale, or CSAM.
• 3+ years of direct federal or DoD privacy compliance experience, including hands‑on execution of PTAs, PIAs, SORN determinations, and Privacy Act requirements.
• Demonstrated knowledge of OMB A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Rev. 5 privacy controls, and CNSSI 1253 privacy overlays.
• Experience managing, mentoring, and reviewing the work of ISSOs or other cybersecurity professionals.
• Experience managing POA&Ms, residual risk, continuous monitoring, vulnerability remediation, and authorization sustainment.
• DoD 8570/8140 IAM Level II certification, such as CISSP, CISM, or CASP+, or ability to obtain within 90 days.
• Active Secret Clearance
• An IAPP privacy certification (CIPP/G, CIPP/US, CIPM, CIPT) or able to obtain within 6 months.
• Strong written and verbal communication skills, including the ability to brief government stakeholders, AOs, and senior leadership on security and privacy risks.

Preferred Qualifications of the ISSM include:

• Hands‑on experience supporting AWS GovCloud authorization packages and cloud security compliance.
• Experience with multiple GRC platforms, including eMASS, Xacta, RegScale, and CSAM.
• Experience supporting cloud-native architectures, Kubernetes, containers, microservices, and DevSecOps/CI/CD environments.
• Familiarity with AWS security services, cloud security controls, and cloud authorization requirements.
• Experience integrating privacy requirements into system architecture, cloud deployments, and security authorization packages.
• Experience with DoD ICAM, Zero Trust, cloud security engineering, and modern authorization approaches.
• Experience supporting cybersecurity incident response, privacy breach response, and significant change assessments.
• Experience working directly with government AOs, SCAs, system owners, and federal privacy offices.
• Experience leading security teams, mentoring junior ISSOs, and establishing authorization processes across multiple systems.

Compensation for the ISSO includes:

• Salary Range: $170,000-180,000
• Benefits including an annual bonus (10%), equity opportunities, medical benefits (100% employer-paid), unlimited PTO, paid federal holidays, home-office stipend, and more

Keywords:

Information Systems Security Manager, ISSM, ISSM Privacy, Information System Security Manager, Information Assurance, IA, Cybersecurity, DoD Cybersecurity, Federal Cybersecurity, Risk Management Framework, RMF, Assessment and Authorization, A&A, Authority to Operate, ATO, Interim Authority to Test, IATT, Continuous Monitoring, ConMon, Security Authorization, eMASS, Xacta, RegScale, CSAM, Governance Risk and Compliance, GRC, NIST SP 800-53, NIST 800-53 Rev 5, CNSSI 1253, Privacy Controls, Privacy Compliance, Federal Privacy, DoD Privacy, Privacy Act, OMB A-130, OMB M-17-12, DoDI 5400.11, Privacy Threshold Analysis, PTA, Privacy Impact Assessment, PIA, System of Records Notice, SORN, Privacy Risk Assessment, Privacy Program, Privacy Engineering, ISSO Leadership, Lead ISSO, Security Control Assessor, SCA, Authorizing Official, AO, System Security Plan, SSP, Security Assessment Report, SAR, Security Control Traceability Matrix, SCTM, Plan of Action and Milestones, POA&M, Residual Risk, Risk Acceptance, Security Impact Analysis, SIA, Significant Change, Vulnerability Management, ACAS, Nessus, STIG, DISA STIG, AWS GovCloud, Cloud Security, Cloud RMF, Cloud Authorization, Kubernetes, Containers, CI/CD, DevSecOps, Cloud Compliance, Security Incident Response, Privacy Breach Response, Security Team Leadership, DoD 8570, DoD 8140, IAM Level II, CISSP, CISM, CASP+, IAPP, CIPP/G, CIPP/US, CIPM, CIPT, Secret Clearance, TS Clearance, TS/SCI, U.S. Citizen

#LI-SW1

#LI-REMOTE