Senior Information System Security Manager with Security Clearance

Cornerstone Defense; Odenton (MD); On-site; USD 145,000 - 165,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

PTO generous

401(k) plan

HSA/FSA options

Life insurance

Disability insurance

Tuition reimbursement

Travel assistance

Job summary

Cornerstone Defense LLC in Odenton, MD is seeking a Senior Information System Security Manager (ISSM) to oversee the cybersecurity posture of DoD systems, manage the RMF lifecycle, and ensure compliance with NIST and DoD requirements.

You will work with cross-functional teams to prepare ATOs, implement risk management, and produce security documentation, tests, and authorization packages, while coordinating with DISA review processes.

Qualifications

• Bachelor's degree plus 8+ years in cybersecurity or Master's with 6+ years.

Responsibilities

• Manage the full RMF lifecycle to achieve and maintain Authority to Operate (ATO).
• Provide ISSM support across FISMA, certification, and accreditation requirements.
• Conduct recurring security control assessments using eMASS and PPSM to maintain accuracy, compliance, and audit readiness.
• Manage IAVA vulnerability records and POA&Ms; track remediation progress.
• Maintain eMASS control records and POA&Ms in alignment with ATO conditions and remediation timelines.
• Coordinate cybersecurity activities for interim and final authorization to test and operate, ensuring assessments and mitigation plans are executed.
• Develop and deliver cybersecurity documentation including tests, reports, implementation plans, STIG/config artifacts, vulnerability assessment reports, and full authorization packages.
• Lead cybersecurity governance activities—managing system architectures, security requirements, protection plans, IAVA actions, and IA compliance objectives.

Skills

RMF lifecycle management

DoD cybersecurity policies

Risk management

Vulnerability assessment

Strong communication

Education

Bachelor's degree + 8+ years experience

Master's degree + 6+ years experience

Tools

eMASS

PPSM

IAVA process

Job description

Title: Senior Information System Security Manager Location: Odenton, MD Compensation Range: $145 - 165k Clearance:

• Active DoD Secret Company Overview: Cornerstone Defense is the Employer of Choice within the Intelligence, Defense, and Space communities of the U.S. Government. Realizing early on that our most prized assets are our employees, we continually focus our attention on improving the overall work/life experience they have supporting the mission. Our Team is pushed every day to use their industry leading knowledge to provide end-to-end solutions to combat our nation's toughest and most secure problems. If you are looking for a place to not only be professionally challenged, but encouraged and supported by a company that cares, don't look any further than Cornerstone Defense. Benefits Overview: Cornerstone Defense offers a very comprehensive benefits package including, but not limited to: Medical, Dental and Vision Plans
• Generous PTO Policy
• 401(k)
• HSA and FSA options
• Life and Disability Insurance
• Tuition Reimbursement and Training
• Perks at Work Discount Program
• Referral Program
• Leads Generation Program
• CollegeAmerica 529
• Fitness Reimbursement Program
• Travel Assistance
• Norton Lifelock Benefit Solutions
• Life Planning Financial & Legal Services
• Position Description: The Senior Information System Security Manager (ISSM) oversees the cybersecurity posture of DISA systems, ensuring compliance with DoD security requirements and safeguarding sensitive information. This role includes full lifecycle ownership of the Risk Management Framework (RMF) process, development and execution of cybersecurity policies, continuous monitoring, vulnerability management, security documentation oversight, and coordination with cross-functional engineering and program teams. The ISSM ensures systems remain secure, accredited, and fully compliant with DoD standards. Core Tasks:
• Manage the full RMF lifecycle to achieve and maintain system Authority to Operate (ATO).
• Provide ISSM support across FISMA, certification, and accreditation requirements.
• Conduct recurring assessments of security controls and documentation within eMASS and PPSM to maintain accuracy, compliance, and audit readiness.
• Manage whitelist records and address vulnerabilities identified through IAVMS scans; develop and track POA&Ms.
• Maintain eMASS control records and POA&Ms in alignment with ATO conditions, approval requirements, and remediation timelines.
• Coordinate cybersecurity activities for interim and final authorization to test and operate-ensuring assessments, mitigation planning, patch validation, and reporting are executed effectively.
• Develop and deliver cybersecurity documentation including test plans, test reports, implementation plans, STIG/configuration artifacts, vulnerability assessment reports, and full authorization package materials.
• Lead cybersecurity governance activities-managing system architectures, security requirements, protection plans, IAVA actions, and IA compliance objectives.
• Prepare documentation, evidence, and briefings for DISA OAB reviews and support the team throughout the review and adjudication process. Qualifications:
• Bachelor's degree with 8+ years of experience or Master's degree with 6+ years (additional experience may substitute for education).
• CISSP, CISM, or equivalent senior-level cybersecurity certification.
• Detailed knowledge of DoD cybersecurity policies, frameworks, and standards such as NIST 800-53, RMF, FISMA, ICD 503, and JSIG.
• Extensive experience maintaining ATOs for DoD enterprise systems.
• Experience with system security engineering, risk management, and vulnerability assessment methodology.
• Strong understanding of network security principles and common cyber tools (firewalls, IDS/IPS, SIEM, endpoint protection).
• Ability to operate independently and collaboratively across cross-functional teams.
• Excellent communication skills with experience preparing and presenting detailed cybersecurity reports. Preferred:
• Experience managing security for complex DoD programs or mission-critical systems.
• Hands-on experience with vulnerability scanning, penetration testing, and audit tools.
• Advanced certifications such as CISA, CEH, CSSP, etc.
• Experience with configuration and change management processes in secure environments.
• Experience supporting automation processes and continuous ATO (cATO) initiatives.