Information Systems Security Manager

Zachary Piper Solutions is seeking an Information Systems Security Manager (ISSM) professional to support a federal and DOD cybersecurity mission. The ISSM will lead RMF execution, security authorization, continuous monitoring, and federal privacy compliance across secure cloud-native systems and environments. This position combines hands-on cybersecurity authorization leadership with direct federal privacy program execution, requiring expertise in eMASS, ATO package management, NIST security and privacy controls, and AWS GovCloud. The ideal candidate will have experience leading ISSOs, managing multiple concurrent authorization packages, advising government stakeholders on risk and compliance, and implementing privacy requirements across federal information systems.

Responsibilities of the ISSM include:

• Lead and oversee DoD RMF activities and security authorization processes across multiple information systems and cloud-based environments.
• Manage multiple concurrent ATO, IATT, and authorization packages throughout their lifecycle
• Maintain accountability for security authorization packages, including SSPs, SARs, SCTM), POA&Ms, & supporting documentation
• Provide expert-level hands-on administration and execution within eMASS & an additional GRC platform (Xacta, RegScale, CSAM)
• Lead continuous monitoring activities, vulnerability management, security control assessments, residual risk analysis, and remediation tracking.
• Oversee and mentor ISSOs, review authorization artifacts, ensure quality and consistency, and provide technical guidance across security teams.
• Coordinate with AOs, SCAs, government stakeholders, system owners, and engineering teams on authorization decisions and risk acceptance.
• Lead federal and DoD privacy compliance activities, including PTAs, PIAs, SORNs, & privacy determinations.
• Ensure compliance with the Privacy Act, OMB A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Rev. 5 privacy controls, and CNSSI 1253 privacy overlays.
• Integrate privacy requirements into RMF authorization packages, system design, control implementation, and continuous monitoring processes.
• Support AWS GovCloud security authorization and cloud compliance activities, including cloud-native architectures, containers, Kubernetes, and CI/CD environments.
• Assess security and privacy risks associated with system changes, cloud deployments, software releases, and new capabilities.
• Support SIAs, significant change reviews, incident response, and privacy breach response procedures.
• Brief government leadership and stakeholders on authorization status, cybersecurity risks, privacy compliance, remediation activities, and recommended risk mitigation strategies.

Qualifications of the ISSM include:

• 7+ years of hands-on DoD or federal cybersecurity, Information Assurance (IA), and RMF experience.
• 3+ years serving as an ISSM or Lead ISSO with accountability for multiple ATO packages and security authorization lifecycles.
• Demonstrated experience leading RMF execution, authorization package development, continuous monitoring, and risk management across multiple systems.
• Expert-level hands-on eMASS experience and working proficiency with an additional GRC platform such as Xacta, RegScale, or CSAM.
• 3+ years of direct federal or DoD privacy compliance experience, including hands-on execution of PTAs, PIAs, SORN determinations, and Privacy Act requirements.
• Demonstrated knowledge of OMB A-130, OMB M-17-12, DoDI 5400.11, NIST SP 800-53 Rev. 5 privacy controls, and CNSSI 1253 privacy overlays.
• Experience managing, mentoring, and reviewing the work of ISSOs or other cybersecurity professionals.
• Experience managing POA&Ms, residual risk, continuous monitoring, vulnerability remediation, and authorization sustainment.
• DoD 8570/8140 IAM Level II certification, such as CISSP, CISM, or CASP+, or ability to obtain within 90 days.
• Active Secret Clearance
• An IAPP privacy certification (CIPP/G, CIPP/US, CIPM, CIPT) or able to obtain within 6 months.
• Strong written and verbal communication skills, including the ability to brief government stakeholders, AOs, and senior leadership on security and privacy risks.

Preferred Qualifications of the ISSM include:

• Hands-on experience supporting AWS GovCloud authorization packages and cloud security compliance.
• Experience with multiple GRC platforms, including eMASS, Xacta, RegScale, and CSAM.
• Experience supporting cloud-native architectures, Kubernetes, containers, microservices, and DevSecOps/CI/CD environments.
• Familiarity with AWS security services, cloud security controls, and cloud authorization requirements.
• Experience integrating privacy requirements into system architecture, cloud deployments, and security authorization packages.
• Experience with DoD ICAM, Zero Trust, cloud security engineering, and modern authorization approaches.
• Experience supporting cybersecurity incident response, privacy breach response, and significant change assessments.
• Experience working directly with government AOs, SCAs, system owners, and federal privacy offices.
• Experience leading security teams, mentoring junior ISSOs, and establishing authorization processes across multiple systems.

Compensation for the ISSO includes:

• Salary Range: $170,000-180,000 **depending on experience**
• Benefits including an a nnual bonus (10%), equity opportunities me dical benefits (100% employer-paid), unlimited PTO, paid federal holidays, home-office stipend, and more

Keywords:

Information Systems Security Manager, ISSM, ISSM Privacy, Information System Security Manager, Information Assurance, IA, Cybersecurity, DoD Cybersecurity, Federal Cybersecurity, Risk Management Framework, RMF, Assessment and Authorization, A&A, Authority to Operate, ATO, Interim Authority to Test, IATT, Continuous Monitoring, ConMon, Security Authorization, eMASS, Xacta, RegScale, CSAM, Governance Risk and Compliance, GRC, NIST SP 800-53, NIST 800-53 Rev 5, CNSSI 1253, Privacy Controls, Privacy Compliance, Federal Privacy, DoD Privacy, Privacy Act, OMB A-130, OMB M-17-12, DoDI 5400.11, Privacy Threshold Analysis, PTA, Privacy Impact Assessment, PIA, System of Records Notice, SORN, Privacy Risk Assessment, Privacy Program, Privacy Engineering, ISSO Leadership, Lead ISSO, Security Control Assessor, SCA, Authorizing Official, AO, System Security Plan, SSP, Security Assessment Report, SAR, Security Control Traceability Matrix, SCTM, Plan of Action and Milestones, POA&M, Residual Risk, Risk Acceptance, Security Impact Analysis, SIA, Significant Change, Vulnerability Management, ACAS, Nessus, STIG, DISA STIG, AWS GovCloud, Cloud Security, Cloud RMF, Cloud Authorization, Kubernetes, Containers, CI/CD, DevSecOps, Cloud Compliance, Security Incident Response, Privacy Breach Response, Security Team Leadership, DoD 8570, DoD 8140, IAM Level II, CISSP, CISM, CASP+, IAPP, CIPP/G, CIPP/US, CIPM, CIPT, Secret Clearance, TS Clearance, TS/SCI, U.S. Citizen

#LI-SW1

#LI-REMOTE