Information Systems Security Manager (ISSM)

Description of Task to be Performed:

AnaVation is seeking a highly motivated Information Systems Security Manager (ISSM) who is responsible for cybersecurity engineering, cyber policy, and Risk Management Framework (RMF) activities supporting Department of Defense software factories and enterprise cloud environments. The ISSM will serve as the cybersecurity lead supporting one or more agile teams, integrating directly with Government leadership, Cyber Operations Teams (COT), Cyber Penetration Teams (CPT), Product Owners, Software Engineers, and DevSecOps personnel to maintain secure cloud-native capabilities while accelerating software delivery through Continuous Authority to Operate (cATO). This position supports enterprise cybersecurity operations spanning multiple mission value streams and classified environments, ensuring secure software delivery while balancing mission execution, cybersecurity risk, and compliance with Department of Defense policies. The position requires full-time support within classified environments in San Antonio, Texas, with routine collaboration across mission engineering, cybersecurity, operations, and acquisition organizations.

Position Responsibilities: The ISSM will provide technical leadership supporting cybersecurity engineering, RMF execution, and continuous cybersecurity operations across software delivery environments.

Responsibilities include:

• Lead RMF implementation supporting initial ATOs and Continuous ATO (cATO).
• Serve as the cybersecurity lead supporting multiple mission value streams.
• Develop and maintain RMF authorization packages including SSPs, SARs, POA&Ms and supporting artifacts.
• Coordinate cybersecurity assessments with Authorizing Officials, Security Control Assessors, penetration testing teams, and engineering organizations.
• Integrate cybersecurity requirements into Agile and SAFe software development activities.
• Support planning, execution, remediation, and continuous monitoring.
• Ensure cybersecurity controls remain operational across development, testing, staging, and production environments. 
• Coordinate vulnerability management, STIG implementation, POA&M tracking, and security control validation.
• Support Zero Trust implementation, cloud security, Kubernetes/OpenShift security, container hardening, and DevSecOps pipeline security. 
• Evaluate cybersecurity risks and provide mitigation recommendations supporting mission operations.
• Support annual cyber assessments, inspections, and operational readiness activities.
• Develop executive-level briefings, risk assessments, and cybersecurity recommendations.
• Support operations across Unclassified, Secret, and SCI environments as required.