Description
The Information Systems Security Manager (ISSM) II will serve as a principal advisor on all matters, technical and otherwise, involving the security of information systems under their purview.
Responsibilities:
- Perform oversight of the development, implementation and evaluation of information system security program policy;
- Develop and oversee operational information systems security implementation policy and guidelines of network security;
- Advise customer on Risk Management Framework (RMF) assessment and authorization issues;
- Perform risk assessments and make recommendations to DoD agency customers;
- Develop and maintain a formal Information Systems Security Program;
- Ensure that all IAOs, network administrators, and other cyber security personnel receive the necessary technical and security training;
- Develop, review, endorse, and recommend action by the AO or DAO of system assessment documentation;
- Ensure approved procedures are in place for clearing, sanitizing, and destroying various types of hardware and media;
- Develop and execute security assessment plans;
- Maintain a repository for all system authorization documentation and modifications;
- Institute and implement a Configuration Control Board (CCB) charter;
- Develop policies and procedures for responding to security incidents;
- Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered;
- Ensure that data ownership and responsibilities are established for each authorization boundary;
- Ensure development and implementation of an information security education, training, and awareness program;
- Evaluate threats and vulnerabilities to ascertain whether additional safeguards are needed;
- Assess changes in the system, its environment, and operational needs that could affect the authorization;
- Ensure that authorization is accomplished and a valid Authorization determination has been given for all authorization boundaries;
- Review AIS assessment plans;
- Coordinate with PSO or cognizant security official on approval of external information systems;
- Conduct periodic assessments of the security posture of the authorization boundaries;
- Ensure configuration management (CM) for security-relevant changes to software, hardware, and firmware;
- Ensure periodic testing is conducted to evaluate the security posture of IS;
- Ensure that system recovery and reconstitution processes developed and monitored;
- Ensure all authorization documentation is current and accessible;
- Ensure that system security requirements are addressed during all phases of the system life cycle;
- Develop Assured File Transfers (AFT) on accordance with the JSIG;
- Participate in self-inspections;
- Conduct the duties of the Information System Security Officer (ISSO) if one is not present.
Requirements:
- 7+ years related experience;
- Prior performance in roles such as ISSO or ISSM;
- SAP experience required;
- Bachelor’s degree in related discipline OR Associate’s degree in a related area + 2 years’ experience OR equivalent experience;
- IAT Level 3 (CISSP, CASP+, CE, CCNP Security, CISA, etc.) or IAM Level 3;
- Active/Current TS/SCI clearance;
- Must be able to obtain CI Poly.