ISSM FedRAMP and DoW Security

Introduction:

The Information System Security Manager (ISSM) is responsible for providing strategic direction, staff management, and advocating on behalf of the security program to ensure compliance with all applied security frameworks, laws, and regulations. This role leads the PowerTrain information security department and directly reports to the Vice President of Cyber Operations.

Responsibilities:

• Provide due care and diligence in all matters of federal information security compliance
• Lead Governance Risk and Compliance (GRC) staff in compliance with current federal information security regulatory landscape
• Coordinate internal auditing and continuous monitoring activities
• Review and approve documentation including compliance reports for accuracy and regulatory compliance
• Ensure timely disclosure of information security incidents and vulnerabilities
• Oversee supply chain risk management strategy and investigation efforts
• Provide direction and leadership for a small team of five FTE staff members
• Provide general oversight of security initiatives and facilitate communication across different teams
• Chair the Change Control Board Internal Security Council
• Delegate security-related engagements with customers and vendors
• Actively communicate with customer security teams
• Inform senior leadership of relevant changes in federal information security regulations
• Ensure timely completion of third-party security audits
• Develop corporate security awareness outreach initiatives
• Work closely with other IT teams to integrate security practices
• Provide guidance and support to departments across the organization

Requirements:

Required Skills:

• Experience in federal information security compliance
• Strong leadership and management skills
• Ability to oversee supply chain risk management
• Excellent communication and collaboration abilities

Preferred Skills:

• Knowledge of Governance Risk and Compliance (GRC) frameworks
• Experience with coordinating internal auditing activities
• Previous experience in incident response management
• Understanding of security awareness initiatives