Senior Information Systems Security Manager – ISSM

This is a fully remote position, open to applicants in District of Columbia.

📋 Description

• Take ownership of IL5 and IL6 authorization packages from beginning to end as the designated ISSM for Virtualitics, including SSPs, control narratives, POA&Ms, significant change reviews, continuous monitoring, and annual assessments.

• Develop the reciprocity playbook, along with necessary artifacts and evidence pipeline to streamline the time-to-ATO for new clients.

• Serve as the primary technical contact for sponsor AOs, 3PAOs, and customer security reviewers.

• Manage the CUI boundary, covering everything from scoping and control implementation to deficiency tracking and assessment readiness.

• Execute FedRAMP alignment, SOC 2 compliance, customer security questionnaires, and due diligence processes.

• Automate the collection of evidence utilizing Python, Bash, SQL, and APIs.

• Collaborate with engineers to convert controls into actionable acceptance criteria and to design requirements for systems.

⛳️ Requirements

• Demonstrated personal ownership of a DoD IL4/IL5/IL6, FedRAMP Moderate/High, or agency ATO package managed end to end.

• Extensive working knowledge of NIST 800-53, NIST 800-37 (RMF), and the DoD Cloud Computing SRG.

• Capacity to assess cloud technical architectures and determine compliance with regulatory objectives.

• Proficiency in reading Terraform, navigating a CI/CD pipeline comprehensively, understanding Kubernetes deployments, and critically evaluating engineering designs based on technical merits.

• Skilled in AI-native workflows and agentic tools, such as Claude Code.

• Ability to produce assessor-grade writing for control narratives and security documentation.

• Experience in direct interactions with AOs, 3PAOs, or external assessors.

• U.S. citizenship is mandatory.

• Active Secret clearance is preferred; the company is willing to sponsor the right candidate.

• IAM Level II or III certification (CISSP, CISM, or CASP+) per DoD 8140, either held or attainable within six months of hiring.

• Familiarity with government hosting or authorization partners such as Palantir FedStart or Second Front Game Warden.

• Experience with OSCAL or other machine-readable control documentation.

• Background in GRC/evidence automation platforms like RegScale, Xacta, Drata, or eMASS.

• Experience in CMMC scoping or assessment specific to a CUI boundary.

• CCP or CCA designation is a plus.

• Knowledge of CNAPP and container scanning tools, including Wiz, Trivy, Anchore, or Tenable.

• Familiarity with Okta, Zscaler, GitHub, JIRA, and Slack.

• Experience in scaling Series C/Series D startups.

🏝️ Benefits

• Meaningful equity participation.

• Comprehensive medical, dental, and vision coverage fully paid for you and your dependents.

• Unlimited PTO.

• Flexible work arrangements.

• Options for remote work and hybrid arrangements for team members located in the Los Angeles or Washington, DC areas.