Position Summary
The Information Systems Security Manager (ISSM) will be responsible for administering the Cyber Security program, managing information systems security officers, working with the authorizing official and authorizing official designated representative, maintaining the cybersecurity architecture and infrastructure of all security boundaries, and implementing all Cyber Security programs necessary to support U.S. Government regulatory requirements, (DOE/NNSA, NIST, etc.). The ISSM is an expert in U.S. Government regulatory requirements.
The candidate will report directly to the CIO.
Essential Duties/Responsibilities (may include, but are not limited to):
- Oversight of the tasks performed by personnel supporting Cyber Security requirements on information systems
- Organizing and leading cross-functional teams to plan and implement Cyber Security initiatives
- Works and communicates collaboratively with all of IT and federal staff
- Maintains record copies of the Certification and Accreditation Packages (C&A) and ensures that a record copy of all elements of it are maintained.
- Ensures each Information System Security Officer (ISSO), as well as other key members of IT, are aware of and fulfills his/her Cyber Security duties.
- Ensures the development, documentation and presentation of Cyber Security education, awareness, and training activities for management, Cyber Security personnel, application owner, data steward, and users.
- Establishes, documents, and monitors the Cyber Security program implementation and ensures compliance with the applicable organization policies and Government regulations. Upon completion of each assessment or review, the ISSM must ensure that a corrective action plan is prepared and implemented for all findings or vulnerabilities.
- Identifies and documents specific threats to information systems and information at the Site, develops and documents additional or modified protection measures for those threats, and obtains approvals for the modified protection measures from the cognizant Authorizing Official.
- Ensures the C&A packages are coordinated with other Site Plans/Programs
- Ensures the development of procedures and policies to implement the Cyber Security program on all information systems.
- Certifies to the cognizant Government official(s) that the protection requirements described in the C&A for each information system have been implemented and are operational
- Ensures that the cognizant Government official(s) is notified when the information system is no longer needed or when changes occur that might affect the accreditation of the information system.
- Ensures the development, documentation, and presentation of Cyber Security training for escorts in information systems operational areas.
- Ensures that each information system user acknowledges, in writing or electronically his/her responsibility for the security of information systems and information;
- Implements and maintains a Cyber Security self-assessment program, identifies corrective actions resulting from the self-assessments, and reports on the program status.
- Leads the Cyber Security Incident Response Team (CSIRT) and communicates incident reports to the appropriate organization and Government authorities.
- Participating in system design specification development with information system owners and subject matter experts to develop creative security systems to solve business problems while meeting site security requirements.
- Work directly with the management staff and IT staff to ensure the Cyber Security strategy is aligned and supports the operating unit and service center goals.
- Trains, mentors, and provides direction to more junior staff.
Minimum Qualifications (Knowledge, Skills, Abilities):
- Candidate must demonstrate the ability to lead cross-functional project teams
- Must have experience at directing the work of other highly skilled, technical employees
- Must have an expert knowledge of system functions, Cyber Security policies, and Cyber Security protection requirements
- Must have excellent communications skills in order to effectively interact with business, Information Technology personnel, and Government agencies
- Must have experience in at least 3 of the following technology vendors: Cisco FirePower, CarbonBlack, Cylance, DataLocker, Entrust, FireEye, ivanti, Tenable, and/or Zscaler.
- Must be able to maintain confidentiality when working with sensitive information.
- All qualified applicants will be considered; however, the successful candidate must be able to obtain and maintain a Q clearance from the United States Department of Energy.
Education and Experience Required:
Bachelors' degree in Information Systems, Computer Science, Management Information Systems, or a related discipline combined with 15 years of related experience, or Masters' degree in Information Systems, Computer Science, Management Information Systems, or a related discipline with 13 years of related experience. Furthermore, the ISSM, must currently hold the CISSP or GSLC certification. Preferred experience is with DOE or NNSA.
Education Equivalency: 2 years of relevant experience for 1 year of college.
Business Associations:
Serves as prime consultant and external spokesperson for the organization on highly significant matters relating to policies, programs, capabilities, and long-range goals and objectives.
Impact:
Decisions affect the financial, employee, or public relations posture of the organization. Erroneous decisions or recommendations would normally result in failure to achieve goals critical to the major objectives of the organizations.
Working Conditions and Physical Requirements:
Normally assigned to perform work in an office environment. Only electrical hazards and other minor potential hazards normally found in an office environment are anticipated. Job performance requires adequate visual acuity and manual dexterity for meeting the requirements of the discipline. Office work environment.
Safety, Security, and Quality
While working to achieve the clients objectives, the ISSM will ensure all activities and operations are performed in a safe and deliberate manner to include protecting the confidentiality and integrity of Personally Identifiable Information (PII). This role will maintain required safety, security and operational training; assure procedural and regulatory compliance; and make safety, security and quality an integral part of every task; including taking the necessary steps to stop work if continuing the job is unsafe or compromises security. Ability to obtain a Q level Department of Energy security clearance.
