Edtech.com's Summary

Ohio State University is hiring an Information System Security Manager - ISSM. The role manages cybersecurity compliance for the university’s National Security Program, protecting classified research data, information systems, and cryptographic equipment under federal security standards. The manager reports to the Senior Facility Security Officer in the university’s research integrity office and works with the Chief Information Security Officer and research leadership.

Highlights

Oversee the lifecycle of System Security Plans, security control validation, and vulnerability remediation for the systems that support classified research, including their accreditation and continuous monitoring.
Manage accountability and operational oversight of Communications Security (COMSEC) materials, keying material, and cryptographic hardware such as TACLANE, KG-series, and KIV devices, tracked in eMASS and KMI/EKMS databases.
Perform system audits and vulnerability assessments using Nessus/Tenable, Splunk, the SCAP Compliance Checker, and DISA STIGs.
Serve as primary contact for external security inspections and audits from oversight authorities such as DCSA and Command Cyber Readiness Inspections.
Work with system owners, control assessors, Authorizing Officials, and technical teams to enforce compliance policies, evaluate third-party RMF packages, and investigate technical anomalies or COMSEC compromises.
Bachelor’s degree in a field such as computer science, cybersecurity, or information technology (or equivalent experience) and 6 years of experience, including at least 2 years managing DoD RMF, DAAPM, or NISPOM compliance and building RMF packages such as SSPs and POA&Ms.
U.S. citizenship with eligibility for an active national security clearance at the Secret level or higher.
Preferred qualifications include 8 or more years of experience, COMSEC program experience, and a DoD 8570/8140 IAM Level II or III certification such as CISSP or CISM.
Pay range of $104,000 to $135,000, with a hybrid arrangement considered although most duties require presence on campus.

Information System Security Manager - ISSM Full Description

Position Overview

The Information System Security Manager (ISSM) plays a key role in the execution and oversight of Ohio State University’s National Security Program cybersecurity compliance, ensuring system integrity, classified data protection, and cryptographic security across national security and classified research initiatives. The position provides security program management and is responsible for supporting the development, implementation, accreditation, and continuous monitoring of information systems, as well as the management, control, accountability, and operational oversight of Communications Security (COMSEC) materials, cryptographic equipment, Controlled Cryptographic Items (CCI), and keying material. Compliance must be maintained under federal cybersecurity standards and national security directives, including the DoD Risk Management Framework (RMF), NIST SP 800-53, NIST SP 800-171, DoD CMMC, DAAPM, NISPOM, NSA COMSEC policies, and CNSSI directives. This position reports to the Sr. Facility Security Officer (Sr. FSO) within ERIK Research Integrity and collaborates with the Sr. FSO, Chief Information Security Officer (CISO), and institutional research leadership to maintain accredited operations.

Utilizing highly complex technical knowledge, this position oversees the end-to-end lifecycle of System Security Plans (SSPs), security control validation, vulnerability remediation, and the lifecycle management of cryptographic hardware such as TACLANE, KG-series, KIV devices, and secure phones. The ISSM performs system audits and vulnerability assessments using technical security tools—including Nessus/Tenable, Splunk, Security Content Automation Protocol (SCAP) Compliance Checker, and DISA STIGs—while maintaining accurate accounting records in government tracking databases such as eMASS and electronic key management systems (KMI/EKMS).

The ISSM serves as the primary contact for external security inspections, tests, command audits, and reviews conducted by oversight authorities (e.g., DCSA, Command Cyber Readiness Inspections). The position works closely with system owners, control assessors, Authorizing Officials, privileged users, and technical teams to enforce compliance policies, evaluate third-party RMF packages, investigate technical anomalies or COMSEC compromises, and maintain a robust security posture across operational systems.

Required Qualifications

Bachelor’s degree in Computer Science, Cyber Security, Engineering, Information Technology, Software Engineering or an equivalent combination of education and experience.
6 years of relevant experience.
U.S. Citizenship with an active national security clearance eligibility at the final Secret level or higher, or eligible to receive a clearance.
Minimum of 2 years of direct experience in information security roles managing DoD RMF, DAAPM, or NISPOM compliance frameworks.
Experience developing and maintaining RMF packages, including System Security Plans (SSPs), Security Control Traceability Matrices (SCTMs), and Plans of Action and Milestones (POA&Ms).
Familiarity with the NIST frameworks including NIST SP 800-53 and NIST SP 800-171.
Experience with security tools and enterprise tracking databases, including eMASS, Nessus, Splunk, SCAP Compliance Checker, DISA STIGs, KMI, or EKMS.
Strong technical background across networking components, operating systems, and privileged user management.
Superior verbal and written communication skills to articulate technical risks, author SOPs and security policies, and collaborate effectively with diverse stakeholders.
Attention to detail.

Desired Qualifications

8 or more years of relevant experience.
2 years of experience in COMSEC specialty programs, procedures, key management policies, and asset control.
Technical familiarity with cryptographic equipment (TACLANE, KG/KY/KIV devices, fill devices) and secure telephony systems.
Experience preparing systems to meet requirements for a NIST SP 800-171 or NIST SP 800-53 assessment.
Experience defining and documenting system boundaries and data flows.
DoD 8570 / 8140 IAM Level II or III Certification (e.g., CISSP, CISM, GSLC, CASP+ CE).
Completion of DAAPM Section 3.6 ISSM Required Training through the Center for Development of Security Excellence (CDSE).
5 or more years of cybersecurity experience within classified DoD or Intelligence Community (IC) environments.
Formal completion of the NSA / DoD COMSEC Custodian Course and KMI / EKMS Training.

Application Materials

A resume and cover letter are required to be submitted at the time of application to be considered for this position.

Salary

The job profile’s pay range is $104,000-$135,000. The salary that will be offered for this position will likely fall within this range and based on internal equity, the candidate’s relevant work experience and qualifications, and the unit’s available budget, which is the primary determining factor.

Work Location

We are open to considering candidates interested in hybrid work arrangements, although most of the job duties will require presence on campus.

Additional Information

Due to U.S. export control regulation regulations governing information, technology, and facilities accessed during the performance of this work, the successful applicant must be a:

U.S. citizen or national;
permanent resident;
asylee or refugee;
individuals otherwise described protected individuals pursuant to Title 8 U.S. Code Section 1324b(a)(3)(b).

Position Type: Regular. Scheduled Hours: 40. Shift: First Shift. Location: Mount Hall (0311).

Final candidates are subject to successful completion of a background check. A drug screen or physical may be required during the post offer process.

The university is an equal opportunity employer, including veterans and disability.

Let me find your next job.

Thanks - you're signed up.

Information System Security Manager - ISSM

Edtech.com's Summary

Information System Security Manager - ISSM Full Description

Information Security Analyst

Director, Information Security

Analyst, Cybersecurity Governance, Risk and Compliance

Cybersecurity Engineer (GTRI-Info & Cybersecurity Dept)

Senior Cybersecurity Program Manager