Information Systems Security Manager

Information Systems Security Manager (ISSM) + Privacy

Second Front Systems is looking for a mission-focused, privacy-expert, decisive Information Systems Security Manager (ISSM) + Privacy to strengthen our cybersecurity and authorization function.

Operating at the RMF and continuous monitoring cadence for a defense software platform and its customer systems, you will be responsible for owning authorization status, risk posture, privacy compliance, and continuous monitoring across an assigned system portfolio.

You will manage concurrent RMF workflows in eMASS and other GRC tools, lead privacy authorization work, and serve as primary government interface, ensuring that all systems maintain valid ATOs, privacy controls meet DoD and federal requirements, and residual risk is visible to leadership and Authorizing Officials.

We need someone capable of directing ISSO teams and quality-review authorization packages for completeness and rigor; authoring Privacy Threshold Analyses, Privacy Impact Assessments, and SORN determinations under the Privacy Act, OMB Circular A-130, and DoD 5400.11-R; and mapping PII and CUI data flows across cloud-native systems and recommending practical privacy controls aligned with NIST 800-53 Rev 5 and CNSSI 1253 privacy overlays.

As a key partner to Authorizing Officials, Security Control Assessors, DoD privacy officers, and customer security teams, you will brief risk and authorization status, escalate material risks, and maintain readiness for assessments and reciprocity decisions, serving as the authoritative voice on how PII is protected and authorized across the company's DoD environment.

Note: Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO This is a full-time position.

What You'll Do

• Own authorization status, risk posture, privacy compliance, and continuous monitoring health across an assigned system portfolio.
• Orchestrate concurrent RMF workflows in eMASS and other GRC tools (Xacta, RegScale, CSAM) from categorization through continuous monitoring.
• Direct and mentor ISSOs supporting the portfolio, assign work, review authorization packages for quality, and coach on security and privacy requirements.
• Govern privacy authorization across all systems, authoring PTAs, PIAs, SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls and CNSSI 1253 overlays.
• Synchronize PII and CUI data flows with ISSEs and Solutions Architects to ensure accurate identification and documentation in authorization packages and system designs.
• Assess residual security and privacy risk across the portfolio, make risk acceptance and POA&M recommendations, and escalate material risks to leadership and Authorizing Officials.
• Mitigate breach response risk by maintaining incident and breach-response procedures aligned with OMB M-17-12 and DoD requirements.
• Establish repeatable privacy templates, training materials, and authorization workflows for the wider team, and report privacy posture trends to leadership.

What You Bring

• 7+ years of hands-on DoD cybersecurity, RMF authorization, or information assurance experience, with at least 3 years serving as ISSM, lead ISSO, or equivalent role accountable for multiple ATO packages.
• 3+ years of direct federal or DoD privacy experience, including authoring PTAs and PIAs, making SORN determinations, and implementing NIST 800-53 Rev 5 privacy controls under the Privacy Act, OMB Circular A-130, OMB M-17-12, and DoDI 5400.11.
• Expert hands-on experience managing authorization packages in eMASS plus mastery of at least one additional GRC tool (Xacta, RegScale, or CSAM).
• Demonstrated ability to direct, mentor, and quality-review the work of ISSOs or compliance staff, with proven track record managing multiple concurrent authorization efforts.
• Expert knowledge of NIST 800-53 (Rev 4 and 5), NIST 800-37 RMF, CNSSI 1253 including privacy overlays, and DoD-specific implementation guidance.
• Solid technical literacy in cloud environments (AWS, containers, Kubernetes, CI/CD) and ability to map cloud-native patterns to technical security and privacy controls.
• Active U.S. Secret security clearance; DoD 8570/8140 IAM Level II baseline certification (CISSP, CISM, or CASP+) or ability to obtain within 90 days; IAPP privacy certification (CIPP/G, CIPP/US, CIPM, or CIPT) or ability to obtain within 6 months.
• Strong written and verbal communication skills, including ability to brief Authorizing Officials, privacy officers, and senior leaders on risk, authorization status, and compliance posture.
• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $170,000 - $180,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits:

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful-both in- and outside the workplace.

Perks of Joining Our Team:

• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program Visit our careers page to learn more.

Who We Are:

Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement:

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing:

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team:

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices:

Colorado:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.