Information System Security Manager

About this position: Information System Security Manager in Colorado Springs, CO  

The Essential Duties and Responsibilities are intended to present a descriptive list of the range of duties performed for this position and are not intended to reflect all duties performed within the job. Other duties may be assigned. To perform this job successfully, an individual must be able to satisfactorily perform each essential duty. The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions of the position.

Applicants will be notified via email or phone within ten business days regarding application status.

This position is contingent upon award of contract.

Essential Duties & Responsibilities

· Serve as the Information System Security Manager (ISSM) responsible for overseeing cybersecurity, information assurance, and Risk Management Framework (RMF) compliance for assigned information systems and programs.

· Develop, implement, and manage the organization's cybersecurity program to ensure compliance with DoD, Intelligence Community (IC), Federal, and organizational requirements.

· Lead RMF activities throughout the system lifecycle, including system categorization, control implementation, assessment, authorization, continuous monitoring, and risk management.

· Oversee the preparation, maintenance, and submission of cybersecurity authorization packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Security Control Traceability Matrices (SCTMs), and Plan of Action and Milestones (POA&Ms).

· Advise Program Managers, Authorizing Officials (AOs), Information System Owners (ISOs), and senior leadership regarding cybersecurity risks and compliance requirements.

· Manage vulnerability assessment, remediation, continuous monitoring, and cybersecurity risk mitigation efforts.

· Ensure compliance with NIST, DoD, CNSSI, ICD, and organizational cybersecurity policies and directives.

· Supervise and provide technical guidance to Information System Security Officers (ISSOs), Information System Security Engineers (ISSEs), System Administrators, and cybersecurity personnel.

· Coordinate security testing, vulnerability scanning, penetration testing, audits, and inspections.

· Review and approve system security configurations, architecture changes, software implementations, and security control modifications.

· Oversee implementation of cybersecurity controls across classified and unclassified information systems.

· Support incident response activities, cybersecurity investigations, root cause analysis, and corrective action planning.

· Develop cybersecurity policies, procedures, standards, and training programs.

· Provide cybersecurity metrics, compliance reporting, and risk briefings to leadership and government customers.

· Participate in Configuration Control Boards (CCBs), technical reviews, engineering working groups, and program management reviews.

· Ensure all personnel operating information systems comply with security policies, training requirements, and acceptable use standards.

Required (Minimum Necessary) Qualifications

·         Education Requirements:Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, Engineering, Mathematics, or a related technical field. Additional years of qualifying experience may be substituted for education requirements.

·         Minimum of 7 years of experience in cybersecurity, information assurance, information security, systems administration, systems engineering, or related technical disciplines.

·         Minimum of 3 years of experience serving in an ISSM, ISSO, cybersecurity lead, or comparable cybersecurity management role.

·         Experience implementing and managing the Risk Management Framework (RMF) for DoD or Federal information systems.

·         Experience developing and maintaining Authorization to Operate (ATO) packages and related cybersecurity documentation.

·         Experience overseeing vulnerability management, compliance assessments, and security control implementation.

·         Experience managing cybersecurity compliance requirements for classified and unclassified systems.

·         Experience leading teams and coordinating cybersecurity activities across multiple organizations.

·         Strong analytical, leadership, organizational, and communication skills.

·         Experience briefing cybersecurity risks to senior leadership and government stakeholders.

·         Must possess or be eligible to obtain and maintain a Top Secret security clearance.

Knowledge, Skills, Abilities, and Other Characteristics

·         Thorough knowledge of Risk Management Framework (RMF) processes and NIST cybersecurity standards.

·         In-depth understanding of NIST SP 800-53, NIST SP 800-37, DoD Cybersecurity Policies, CNSSI requirements, and Intelligence Community directives.

·         Knowledge of system security architecture, network security, cloud security, virtualization, and enterprise cybersecurity operations.

·         Familiarity with vulnerability management, security assessments, auditing, and continuous monitoring programs.

·         Understanding of security engineering principles and lifecycle cybersecurity integration.

·         Knowledge of incident response, configuration management, and security operations processes.

·         Ability to analyze complex technical risks and communicate recommendations to leadership.

·         Strong documentation, policy development, and technical writing skills.

·         Ability to manage multiple projects, systems, and cybersecurity initiatives simultaneously.

·         Proficiency with Microsoft Office Suite, cybersecurity tools, compliance platforms, and security management systems.

·         Knowledge of organizational procedures and workflows – understanding how work moves through a company.

·         Basic knowledge of relevant technologies or tools – e.g., Microsoft 365, communication platforms, or industry‑standard software.

·         Knowledge of customer service practices – principles of providing quality service and managing inquiries professionally.

·         Knowledge of data privacy and confidentiality principles – awareness of proper handling of sensitive information.

·         Communication skills (written and verbal) – ability to convey information clearly and professionally.

·         Time management and prioritization – balancing multiple tasks and meeting deadlines.

·         Problem‑solving and critical thinking – analyzing issues and selecting appropriate solutions.

·         Interpersonal and teamwork skills – building rapport and collaborating effectively with others.

·         Attention to detail – producing accurate, error‑free work.

Preferred

· Active Top Secret clearance with SCI eligibility or current TS/SCI clearance.

· DoD 8570/8140 IAT Level III or IAM Level III certification requirements satisfied.

· CISSP, CISM, CAP, CASP+, GSLC, SecurityX, or equivalent advanced cybersecurity certification.

· Experience supporting Air Force, Space Force, Army, Navy, SOCOM, Intelligence Community, or other Federal Government environments.

· Experience supporting classified information systems, SCI environments, and Special Access Programs (SAPs).

· Experience managing cybersecurity programs supporting cloud environments such as Azure Government, AWS GovCloud, or hybrid architectures.

· Knowledge of Zero Trust Architecture implementation and cybersecurity modernization initiatives.

· Experience with ACAS, HBSS/ESS, Splunk, Microsoft Defender, eMASS, Xacta, or comparable cybersecurity platforms.

· Experience supporting DevSecOps and secure software development initiatives.

· Prior experience serving as an ISSM, Senior ISSO, Cybersecurity Manager, Cybersecurity Program Manager, or Security Architect.

Necessary Physical Requirements

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this role. Employees must always maintain a constant state of mental alertness. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

·  Must be able to sit and work at a computer workstation for extended periods (frequently).

·  Must be able to review, analyze, and approve technical cybersecurity documentation (frequently).

·  Must be able to communicate effectively during meetings, audits, inspections, and executive briefings (frequently).

·  Must be capable of conducting facility visits, cybersecurity inspections, and system reviews in secure environments (occasionally).

·  Must be able to lift up to 20 pounds of equipment, documentation, or related materials (occasionally).

·  Must be able to travel in support of cybersecurity assessments, inspections, and customer requirements (occasionally).

Work Environment

The work environmental characteristics described here are representative of those that must be borne by an employee to successfully perform the essential functions of the role. Employees must always maintain a constant state of situational awareness. Reasonable accommodation may be made to enable individuals with disabilities to perform the

Physical Setting:

· Primarily performed in government facilities, secure operations centers, SCIFs, engineering environments, and office settings.

· Work may occur in both classified and unclassified information system environments.

· Frequent interaction with Authorizing Officials, Program Managers, engineers, cybersecurity professionals, contractors, and senior government leadership.

Schedule and Flexibility:

· Standard full-time schedule.

· Occasional extended hours may be required to support cybersecurity incidents, inspections, accreditation efforts, system outages, vulnerability remediation activities, or mission requirements.

· Flexibility required to support evolving cybersecurity threats and operational priorities.

Other Pertinent Work Details:

· Must maintain all required security clearances and access authorizations.

· Position may require routine access to classified information up to the Top Secret/SCI level.

· Requires compliance with all applicable cybersecurity, privacy, and security regulations.

· May oversee multiple systems, networks, programs, and cybersecurity professionals simultaneously.

· Requires exceptional integrity, leadership ability, discretion, and attention to detail.

Supervisory Responsibilities

·         This position will have supervisory responsibilities.

DOT Covered/Safety-Sensitive Role Requirements

·         This position is not subject to federal requirements regarding Department of Transportation “safety-sensitive” functions.

Additional Qualifying Factors

As a condition of employment, you will be required to pass a pre-employment drug screening and have acceptable background check results. If applicable to the contract, you must also obtain and maintain the appropriate clearance levels required and must also be able to obtain access to military installations.

Shareholder Preference

BSNC gives hiring, promotion, training, and retention preference to BSNC shareholders, shareholder descendants and shareholder spouses who meet the minimum qualifications for the job.

Bering Straits Native Corporation is an equal opportunity employer.  All applicants will receive consideration for employment without regard to any status protected by state or federal law, or any other basis prohibited by law.