ISSM Security Manager

Astrion; Eglin Air Force Base (FL); On-site; USD 110,000 - 150,000; Full time

Job summary

Astrion is seeking an Information System Security Manager (ISSM) to support the 96 Test Wing at Eglin AFB, FL. This full-time role requires active DoD Secret clearance and demonstrates leadership in the security lifecycle from requirements through verification and deployment.

The ISSM will develop and maintain security artifacts (SSP, SAR, POA&M), oversee STIGs and RMF processes, and coordinate risk management activities with government stakeholders.

Qualifications

• Active DoD Secret clearance required.
• 10+ years as ISSM/ISSE/ISSO/related roles.
• Master’s Degree; degree substitution with experience allowed.
• DoD 8140 Advanced Proficiency Certification for ISSM or equivalent.
• Experience with RMF/DoW/DAF cybersecurity requirements.
• Familiarity with eMASS, ACAS, and endpoint security tools.
• Experience implementing STIG requirements and monitoring.
• Ability to develop SSP/SAR/POA&M documentation.
• Strong collaboration with government and contractors.
• Effective written and verbal communication skills.

Responsibilities

• Advise and assist security implementation across lifecycle phases.
• Develop and manage IATT, ATO, and SIA artifacts.
• Oversee STIG implementation and policy integration.
• Maintain DoD 8140 certification for ISSM.
• Ensure confidentiality, integrity, and availability of classified ISs.
• Assist in Authorization activities at required protection levels.
• Prepare and maintain security documentation (SSP, SAR, POA&M).
• Implement and oversee A&A processes with assessors.
• Manage access control and vulnerability remediation.
• Collaborate with stakeholders and communicate complex security concepts.

Skills

Active DoD Secret clearance

10+ years ISSM/ISSE/ISSO experience

Cybersecurity lifecycle in DoW/DAF

DoD 8140 Advanced Proficiency

Experience with RMF authorization

Experience with eMASS/ACAS

Experience with STIGs

Security incident response experience

Security documentation (SSP/SAR/POA&M)

Leadership communication

Education

Master’s Degree in applicable discipline

Tools

eMASS

ACAS

ESS/MS Defender Suite

Job description

Overview

Security Manager - ISSM

LOCATION: Eglin AFB, FL

JOB STATUS: Full-time

CLEARANCE: Secret; TS/SCI

CERTIFICATION: DoD 8140 Advanced Proficiency Certification

TRAVEL:10%

Astrion has an exciting opportunity foran Information System Security Manager (ISSM) supporting the 96 Test Wing under the Air Force Division located at the Eglin AFB, FL.

REQUIRED QUALIFICATIONS / SKILLS

• Must have an active DoD Secret security clearance.
• The ideal candidate will have 10+ years’ experience as an ISSM/ISSE/ISSO/System Administrator/Network Administrator.
• Master’s Degree in applicable discipline; additional experience may be substituted for the degree.
• DoD 8140 Advanced Proficiency Certification for ISSM or related position.
• Experience with the system security engineering lifecycle for Department of War (DoW)/Department of The Air Force (DAF) programs: They'd understand how security is integrated into the acquisition process, from requirements definition to verification testing and deployment.
• Experience with DoW/DAF Cybersecurity requirements and Risk Management Framework authorization processes.
• Experience managing and executing cybersecurity incident response processes and reporting requirements.
• Experience with the Enterprise Mission Assurance Support Service (eMASS), Assured Compliance Assessment Solution (ACAS), and endpoint security tools (e.g., ESS/MS Defender Suite for Endpoint/Server).
• Experience managing, executing, and reporting on cybersecurity continuous monitoring requirements to include implementing and monitoring Security Technical Implementation Guide (STIG) requirements.

PREFERRED QUALIFICATIONS / SKILLS

• Active Top Secret DoD security clearance

RESPONSIBILITIES

• The candidate shall provide advice and assistance services in support of the implementation of cybersecurity safeguards while developing, coordinating, and implementing short- and long-term strategies during all phases of the system development lifecycle.
• Develop, assess, write, manage, and maintain Interim Authority to Test (IATT), Authority to Operate (ATO), and Security Impact Analysis (SIA).
• Oversee implementation of Security Technical Implementation Guide (STIG) requirements, while interpreting and integrating all applicable policies, instructions, and procedures according to appropriate Security Classification Guides (SCGs).
• Maintain DoD 8140 Advanced Proficiency Certification for ISSM or related position (e.g., Certified Information Systems Security Professional (CISSP)).
• Ensuring the confidentiality, integrity, and availability of classified ISs and data using DoW/DAF approved security engineering standards, industry best practices, and by employing new technologies.
• Advise and assist the Government in performing initial and recurring Authorization of systems or networks at the appropriate protection level as directed by the appropriate cognizant authority.
• Security Planning and Documentation: The ISSM develops and maintains essential security documentation, including:
• System Security Plan (SSP): A comprehensive document that describes the security controls implemented on the system.
• Security Assessment Report (SAR): Documents the results of security assessments and identifies any vulnerabilities.
• Plan of Action and Milestones (POA&M): Tracks the progress of remediating vulnerabilities and implementing security controls.
• Assessment and Authorization (A&A): The ISSM plays a vital role in the A&A process, which is the process of obtaining authorization to operate (ATO) a system. This involves:
• Preparing the system for security assessments.
• Working with security assessors to identify vulnerabilities.
• Developing and implementing corrective action plans.
• Presenting the system to the Authorizing Official (AO) for approval.
• Configuration Management: The ISSM ensures that the information system is configured securely and that all changes are properly authorized and documented.
• Access Control:The ISSM manages access control to the information system, ensuring that only authorized users have access to sensitive data.
• Vulnerability Management:The ISSM identifies, assesses, and mitigates vulnerabilities in the information system. This involves:
• Conducting vulnerability scans.
• Applying security patches.
• Implementing other security measures to protect against known vulnerabilities.
• Collaboration and Communication: The ISSM works closely with other cybersecurity professionals, system administrators, program managers, and other stakeholders to ensure that the information system is secure.
• They need to communicate effectively with both technical and non-technical audiences.