Information Systems Security Manager

Role overview

Lead cybersecurity authorization and privacy compliance across a portfolio of government systems, maintaining authorization status, risk visibility, and continuous monitoring readiness. The work combines hands-on risk management and privacy analysis with oversight of ISSO staff and regular coordination with government security and privacy stakeholders.

Responsibilities

- Manage concurrent Risk Management Framework (RMF) authorization efforts in eMASS and other governance, risk, and compliance tools, from system categorization through continuous monitoring. - Direct and mentor ISSOs, assign work, and review authorization packages for completeness and quality. - Prepare Privacy Threshold Analyses, Privacy Impact Assessments, and System of Records Notice determinations; ensure privacy controls and data flows are accurately represented. - Coordinate with engineering and architecture teams to map personally identifiable information and controlled unclassified information across cloud systems. - Evaluate residual security and privacy risks, recommend risk acceptance decisions and remediation plans, and escalate material issues to leadership and Authorizing Officials. - Maintain incident and breach response procedures, develop reusable privacy guidance and training, and report posture trends.

Requirements

- At least seven years of DoD cybersecurity, RMF authorization, or information assurance experience, including three or more years as an ISSM, lead ISSO, or equivalent accountable for multiple authorization packages. - At least three years of federal or DoD privacy experience, including PTAs, PIAs, SORN determinations, and implementation of privacy controls. - Extensive hands-on experience with eMASS and mastery of at least one of Xacta, RegScale, or CSAM. - Demonstrated ability to lead ISSOs or compliance staff and manage several authorization efforts at once. - Strong knowledge of NIST 800-53 (Revisions 4 and 5), NIST 800-37, CNSSI 1253 privacy overlays, and relevant federal and DoD privacy requirements. - Technical familiarity with cloud environments, containers, Kubernetes, and CI/CD, plus an active Secret clearance and qualifying DoD IAM Level II certification (or ability to obtain one within 90 days); an IAPP privacy certification is also required or must be obtained within six months.

Benefits and work setup

This is a full-time role. Applicants must live in the Washington, D.C., Maryland, or Virginia area, or in Denver or Colorado Springs, and must be U.S. citizens. The stated base salary range is $170,000–$180,000, with potential equity awards and discretionary bonuses. Benefits include employer-paid medical, dental, and vision coverage, a 401(k) contribution, wellness resources, professional development and home-office stipends, flexible paid time off, federal holidays, parental leave, and flexible remote work.