Job Description

Help for Job Description. Opens a new window.

At Whitman, Requardt & Associates, LLP, we are "People Focused and Project Driven." For more than 110 years, we have been known for quality work and quality employees. Join our team and help us design the infrastructure and buildings that improve the world. WRA is seeking a hands-on Information Systems Security Manager to support classified information systems, lead Risk Management Framework authorization and continuous monitoring activities, and help operate WRA's CMMC program and CUI enclave. The position is ideal for an ISSM or experienced ISSO ready to grow into broader program ownership. This is a broad, practical role supporting multiple specialized security environments within a large organization. The ISSM will work across security documentation, compliance, technical analysis, and hands-on implementation. Routine user support is handled by cleared technical staff, but the ISSM must be able to perform ISSO and limited systems administration work when needed. Success requires initiative, curiosity, sound judgment, attention to detail, and a willingness to work outside a narrowly defined lane.

Responsibilities:

• Classified systems and

RMF:

Manage and support authorization, reauthorization, and continuous monitoring for government-sponsored classified systems and local facilities.

• Develop and maintain ATO packages and supporting artifacts, including System Security Plans, control implementation statements, assessment evidence, POA&Ms, agreements, test plans, and technical documentation.
• Perform control assessments, self-inspections, vulnerability management, recurring reporting, and security-impact reviews; coordinate changes and authorization matters with government security stakeholders.
• Maintain authorization information and evidence in eMASS or sponsor-specific systems. Prior eMASS experience is helpful but not required.
• CMMC and CUI enclave: Help lead WRA's CMMC program and CUI enclave, including

NIST SP 800-171

documentation, evidence, policies, POA&Ms, access and change reviews, continuous monitoring, assessment preparation, and remediation tracking.

• Use IntelliGRC to maintain CMMC documentation and evidence, and coordinate shared responsibilities and deliverables with WRA's managed service provider (MSP) and external consultants. Prior IntelliGRC experience is not required.
• Hands-on security: Review logs, configure controls such as multifactor authentication, use vulnerability and compliance scanning tools, apply and remediate SRGs and STIGs, investigate findings, and validate corrective actions.
• Perform ISSO or limited systems administration duties for specific programs and serve as backup to cleared technical staff when needed. This is not primarily a help desk position.
• Support incident response, required reporting, policy and training activities, and clear communication of authorization status, vulnerabilities, risks, and remediation.
• Research unfamiliar requirements and technologies, develop practical recommendations, and perform other related security and IT duties in a small, collaborative environment.