Information System Security Manager (ISSM)

The Defense Technology Solutions Division of Applied Research Associates, Inc. (ARA) is seeking a person to fill the position of an Information Systems Security Manager (ISSM) to join our team in Albuquerque, NM. The Information System Security Manager (ISSM) is responsible for the implementation, management, and day-to-day oversight of the classified information system security program at a specific cleared facility location. Appointed per 32 CFR Part 117 §117.7(b)(5), the ISSM ensures all classified information systems at the facility operate in compliance with the NISPOM Rule, the DCSA Assessment and Authorization Guide (DAAG), NIST SP 800-53, CNSSI 1253, and all applicable CSA cybersecurity requirements.

The ISSM is primarily responsible for the implementation of the risk management framework (RMF). The ISSM serves as the principal advisor on all matters, technical and otherwise, involving the security of systems under their purview. This role requires close coordination with the facility FSO, the Insider Threat Program Senior Official (ITPSO), Information System Security Officers (ISSOs), DCSA Information Systems Security Professionals (ISSPs), and facility IT support staff.

Essential Functions

• Implement and manage the classified information system security program at the division/branch facility in accordance with 32 CFR Part 117 §117.18 and the DAAG.

• Maintain a productive working relationship with DCSA ISSPs and respond promptly to assessment findings and information requests.

• Develop, maintain, and submit System Security Plans (SSPs), security control assessments, and authorization packages for all classified systems at the facility.

• Manage the full RMF lifecycle of facility classified systems ensuring they operate within the parameters of their DCSA-approved security plans

• Complete RMF packages within DCSA timelines for authorization, reauthorization, extension, and decommission workflows within eMASS to ensure operation continuity

• Supervise site-level ISSOs and any support staff performing NISP-related security functions at the facility.

• Conduct regular security control assessments, continuous monitoring and self-inspections of classified information systems

• Manage the facility’s Plan of Action and Milestones (POA&M) for classified systems, tracking open findings to timely resolution.

• Evaluate and ensure compliance with configuration management and change control processes for all system modifications prior to implementation.

• Serve as the facility-level lead for classified information system security incidents coordinating all external reporting through the FSO and corporate security.

• Develop and deliver annual role-based training for all users and administrators of classified information systems at the facility