Information System Security Manager – ISSM

FTI - Frontier Technology Inc.

ISSM overseeing cybersecurity for Army and Navy program environments, leading Risk Management Framework lifecycle and ensuring compliance with cybersecurity directives.

Posted 8/3/2026full-timeVentura • California • 🇺🇸 United StatesMid-LevelSenior💰 $160,000 - $190,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Cybersecurity Management, Risk Management Framework (RMF) lifecycle, and vulnerability assessment tools, with a strong focus on compliance with DoD standards and effective communication with government stakeholders.

Highest-signal resume keywords

Active TS ClearanceDoD 8140/8570 Baseline CertificationAdvanced Operational Capability Using eMASSExperience Managing Vulnerability Assessment ToolsInternal Product Hardening & DevSecOps

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk Management Framework (RMF)NIST SP 800-53Continuous Monitoring (ConMon)Assessment & Authorization (A&A)Vulnerability RemediationStatic/Dynamic Application Security Testing (SAST/DAST)System Hardening StandardsCybersecurity Requirements EmbeddingTechnical Scan Data EvaluationZero-Trust Alignment

Soft Skills

CollaborationNegotiationAdvisory SkillsCommunication

Tools & Technologies

EMASSACASNessusSCAP Compliance CheckerDISA STIGsCIS Benchmarks

Certifications & Qualifications

CompTIA Security+CISSPCISMGSECCloud+

Industry Keywords

CybersecurityDoDI 8510.01NavyArmyComplianceAuthorization to Operate (ATO)Risk ManagementGovernment InspectionsSecurity PostureMission Risk Trade-offs

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityLinuxTypeScript

About the role

Key responsibilities & impact

The Information System Security Manager (ISSM) serves as the primary cybersecurity authority and liaison for contractor-designed, built, and supported networks and systems operating within Army and Navy program environments.
Operates on-site as a trusted advisor and peer to Government ISSMs and cybersecurity leadership, bridging the gap between contractor engineering teams and government accreditation authorities.
Oversees the creation, defense, and maintenance of comprehensive ATO packages within key government repositories, primarily eMASS (Enterprise Mission Assurance Support Service) and Navy/Army-specific workflow databases.
Evaluates contractor-designed architecture, software stacks, hardware configurations, and network topologies against DoD baseline security controls (NIST SP 800-53 R5, CNSSI 1253) to identify and mitigate risks early in the systems engineering lifecycle.
Establishes robust Continuous Monitoring (ConMon) strategies, managing Plan of Action and Milestones (POA&Ms), vulnerability remediation (ACAS/Nessus scans, STIG compliance), and annual assessment reviews to prevent ATO expiration or authorization revocation.
Serve as the primary contractor cybersecurity authority operating directly on-site with Navy Organization ISSMs, AODRs, and AOs to facilitate accreditation processes.
Build, manage, and maintain formal Assessment & Authorization (A&A) packages within eMASS (Enterprise Mission Assurance Support Service) and relevant customer databases, ensuring accurate control allocation and implementation statements.
Evaluate baseline security controls (NIST SP 800-53 Rev. 5, CNSSI 1253) across contractor-designed networks, verifying implementation of administrative, operational, and technical safeguards.
Oversee automated vulnerability assessment tools (ACAS, Nessus, SCAP Compliance Checker), evaluating raw scan results, prioritizing findings, and ensuring required DISA STIGs/SRGs are applied.
Draft, track, and remediate Plans of Action and Milestones (POA&Ms), negotiating acceptable risk levels and mitigation strategies with government stakeholders.
Establish and execute ongoing ConMon strategies to maintain authorization boundaries, managing annual security reviews, boundary modification requests, and re-authorization events.
Collaborate with internal software, network, and systems engineering teams during early development lifecycle phases to embed cybersecurity requirements into company-developed technology before deployment.
Develop and enforce internal baseline configuration guides, utilizing DISA STIGs and CIS Benchmarks across company-built hardware appliances, software stacks, and operating environments.
Evaluate internal product architectures and software deliverables for security posture, facilitating static/dynamic code analysis, dependency scanning, and zero-trust alignment.
Establish company-internal cybersecurity standard operating procedures (SOPs), hardening checklists, and secure development guidelines to ensure consistency across product lines.
Lead protective and corrective measures upon discovery of critical vulnerabilities or zero-day threats affecting deployed customer networks or company solutions.
Coordinate with government security leadership and internal teams to report, contain, investigate, and remediate potential security incidents or policy non-compliance.
Coordinate and prepare systems for formal government cybersecurity inspections, and internal quality audits.
Advise internal engineering managers and government leadership on security posture, mission risk trade-offs, and emerging cybersecurity threats.
Translate complex government compliance requirements (DoDI 8510.01, NIST guidelines) into actionable technical requirements for internal development teams.

Requirements

What you’ll need

Active TS clearance (TS/SCI preferred)
DoD 8140/8570 Baseline Certification (Required): Intermediate Level (Minimum): CompTIA Security+, CompTIA SecurityX (formerly CASP+), Cloud+, GSEC, or equivalent
Advanced Level (Preferred): CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), GCSA, GCIA, or CISSP-ISSMP.
Bachelors in Information Technology, Cybersecurity, Computer Science, Information Systems, Software Engineering or equivalent +5 years of relevant experience supporting Army or Navy customers in the full RMF lifecycle.
Government RMF & Compliance Mastery Demonstrated hands-on experience navigating the complete Risk Management Framework (RMF) lifecycle per DoDI 8510.01, NIST SP 800-53 (Rev. 5), and CNSSI 1253.
Advanced operational capability using eMASS (Enterprise Mission Assurance Support Service) to build, manage, and defend Assessment & Authorization (A&A) packages for Navy customers.
Experience managing vulnerability assessment tools (ACAS/Nessus, SCAP Compliance Checker), evaluating raw technical scan data, and applying DISA STIGs / SRGs.
Proven track record drafting, negotiating, and tracking POA&Ms through mitigation to secure ATO, ATO with Conditions, or Interim Authority to Test (IATT).
Internal Product Hardening & DevSecOps Solid working knowledge of system hardening standards across operating systems (Linux/Windows), network infrastructure, containerized environments, and cloud architectures.
Experience embedding cybersecurity requirements into early software/systems engineering workflows (Shift-Left Security / DevSecOps pipelines).
Familiarity with static/dynamic application security testing (SAST/DAST) tools and software bill of materials (SBOM) management.
Preferred / Desirable Qualifications Direct experience supporting Navy (NAVIFOR / NAVSEA / NAVAIR / SPAWAR) program offices and Authorizing Officials (AOs).
Specialized certifications in audit, risk management, or cloud security (e.g., CISA, CRISC, CCSP, AWS/Azure Security Specialties).

Benefits

Comp & perks

n/a 📊 Check your resume score for this job Improve your chances of getting an interview by checking your resume score before you apply. Check Resume Score