Information Systems Security Manager

This is a fully remote position, open to applicants in Colorado, +1 more state.

📋 Description

• Take ownership of authorization status, risk posture, privacy compliance, and ongoing monitoring health within an assigned system portfolio.

• Coordinate simultaneous RMF workflows in eMASS and other GRC tools, managing processes from categorization through continuous monitoring.

• Lead and mentor ISSOs, delegate tasks, evaluate the quality of authorization packages, and provide guidance on security and privacy standards.

• Oversee privacy authorization for all systems, drafting PTAs, PIAs, SORN determinations, and applying NIST 800-53 Rev 5 privacy controls along with CNSSI 1253 overlays.

• Align PII and CUI data flows with ISSEs and Solutions Architects.

• Evaluate residual security and privacy risks, recommend risk acceptance and POA&M actions, and escalate significant risks to leadership and Authorizing Officials.

• Uphold incident and breach-response procedures in accordance with OMB M-17-12 and DoD requirements.

• Develop privacy templates, training resources, and authorization workflows.

• Communicate privacy posture trends to leadership.

• Act as the primary government liaison and authoritative source on PII protection and authorization within the company's DoD environment.

⛳️ Requirements

• Minimum of 7 years of direct DoD cybersecurity, RMF authorization, or information assurance experience, including at least 3 years in a role such as ISSM, lead ISSO, or equivalent responsible for multiple ATO packages.

• At least 3 years of relevant federal or DoD privacy experience, which includes drafting PTAs and PIAs, making SORN determinations, and applying NIST 800-53 Rev 5 privacy controls in compliance with the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.

• Proficient in managing authorization packages in eMASS and possessing mastery of at least one additional GRC tool (Xacta, RegScale, or CSAM).

• Proven capability to lead, mentor, and review the work of ISSOs or compliance personnel, with a successful history of managing multiple authorization efforts simultaneously.

• In-depth understanding of NIST 800-53 (Rev 4 and 5), NIST 800-37 RMF, CNSSI 1253 including privacy overlays, and DoD-specific implementation guidance.

• Strong technical knowledge of cloud environments (AWS, containers, Kubernetes, CI/CD) and the ability to relate cloud-native patterns to technical security and privacy controls.

• Current U.S. Secret security clearance.

• DoD 8570/8140 IAM Level II baseline certification (CISSP, CISM, or CASP+) or the ability to obtain it within 90 days.

• IAPP privacy certification (CIPP/G, CIPP/US, CIPM, or CIPT) or the ability to acquire it within 6 months.

• Excellent written and verbal communication skills, with the capability to brief Authorizing Officials, privacy officers, and senior leaders on risks, authorization status, and compliance posture.

• U.S. citizenship is a requirement for this position.

• Candidates must reside in one of the designated hiring hubs: DC/Maryland/Virginia or Denver/Colorado Springs, CO.

🏝️ Benefits

• Comprehensive medical, dental, and vision coverage fully paid by the employer for you and your dependents.

• 401(k) plan with a 3% company contribution.

• Extensive wellness benefits, which include a One Medical membership, mental health resources, family planning support, and more.

• Equity incentive program.

• Stipend for new hire technology and home office setup.

• Annual stipend for professional development.

• Flexible paid time off, in addition to all federal holidays.

• Generous parental leave policy.

• Opportunities for flexible remote work.

• Employee referral bonus program.

• Potential eligibility for discretionary bonuses.