Information Systems Security Manager (ISSM) + Privacy
Second Front Systems is looking for a mission-focused, privacy-expert, decisive Information Systems Security Manager (ISSM) + Privacy to strengthen our cybersecurity and authorization function.
Operating at the RMF and continuous monitoring cadence for a defense software platform and its customer systems, you will be responsible for owning authorization status, risk posture, privacy compliance, and continuous monitoring across an assigned system portfolio.
You will manage concurrent RMF workflows in eMASS and other GRC tools, lead privacy authorization work, and serve as primary government interface, ensuring that all systems maintain valid ATOs, privacy controls meet DoD and federal requirements, and residual risk is visible to leadership and Authorizing Officials.
We need someone capable of directing ISSO teams and quality-review authorization packages for completeness and rigor; authoring Privacy Threshold Analyses, Privacy Impact Assessments, and SORN determinations under the Privacy Act, OMB Circular A-130, and DoD 5400.11-R; and mapping PII and CUI data flows across cloud-native systems and recommending practical privacy controls aligned with NIST 800-53 Rev 5 and CNSSI 1253 privacy overlays.
As a key partner to Authorizing Officials, Security Control Assessors, DoD privacy officers, and customer security teams, you will brief risk and authorization status, escalate material risks, and maintain readiness for assessments and reciprocity decisions, serving as the authoritative voice on how PII is protected and authorized across the company's DoD environment.
Note: Candidates must reside in one of our approved hiring hubs:
• DC/Maryland/Virginia
• Denver/Colorado Springs, CO
This is a full-time position.
What You'll Do
• Own authorization status, risk posture, privacy compliance, and continuous monitoring health across an assigned system portfolio.
• Orchestrate concurrent RMF workflows in eMASS and other GRC tools (Xacta, RegScale, CSAM) from categorization through continuous monitoring.
• Direct and mentor ISSOs supporting the portfolio, assign work, review authorization packages for quality, and coach on security and privacy requirements.
• Govern privacy authorization across all systems, authoring PTAs, PIAs, SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls and CNSSI 1253 overlays.
• Synchronize PII and CUI data flows with ISSEs and Solutions Architects to ensure accurate identification and documentation in authorization packages and system designs.
• Assess residual security and privacy risk across the portfolio, make risk acceptance and POA&M recommendations, and escalate material risks to leadership and Authorizing Officials.
• Mitigate breach response risk by maintaining incident and breach-response procedures aligned with OMB M-17-12 and DoD requirements.
• Establish repeatable privacy templates, training materials, and authorization workflows for the wider team, and report privacy posture trends to leadership.
What You Bring
• 7+ years of hands-on DoD cybersecurity, RMF authorization, or information assurance experience, with at least 3 years serving as ISSM, lead ISSO, or equivalent role accountable for multiple ATO packages.
• 3+ years of direct federal or DoD privacy experience, including authoring PTAs and PIAs, making SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls under the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.
• Expert hands-on experience managing authorization packages in eMASS plus mastery of at least one additional GRC tool (Xacta, RegScale, or CSAM).
• Demonstrated ability to direct, mentor, and quality-review the work of ISSOs or compliance staff, with proven track record managing multiple concurrent authorization efforts.
• Expert knowledge of NIST 800-53 (Rev 4 and 5), NIST 800-37 RMF, CNSSI 1253 including privacy overlays, and DoD-specific implementation guidance.
• Solid…