Cybersecurity Information System Security Manager

Title: Cybersecurity Information System Security Manager Location: Irvine, California, United States

ABOUT THE TEAM

The Air Defense team builds robots that find other robots and knock them out of the sky. At a time when air superiority can no longer be taken for granted, the Air Defense team provides mission critical capabilities to warfighters. From detection to tracking, identification, deterrence, and defeat, our family of networked sensors and effectors enables our customers to rapidly close the kill chain against a broad range of UAS threats. Working across product, engineering, business development, logistics, operations, and mission success, the Air Defense team develops, tests, deploys, and sustains the Anduril Air Defense Family of Systems in challenging operational environments worldwide.

ABOUT THE JOB

Anduril's Air Defense division is seeking a Cybersecurity Information System Security Manager (ISSM) to own the cyber compliance posture of our command and control (C2) software systems. This role sits at the intersection of mission-critical software delivery and government cybersecurity accreditation — you will be responsible for building and maintaining the full cybersecurity authorization lifecycle, from policy development through artifact delivery, ensuring our systems meet the rigorous security standards required for Department of Defense deployment.
You will serve as the primary cybersecurity authority for your program, driving the end-to-end Enterprise Mission Assurance Support Service (eMASS) accreditation process, enforcing security standard operating procedures, managing Plans of Action and Milestones (POAMs), and ensuring continuous compliance across development and operational environments. This is not a checkbox role — you will work directly with engineers, program managers, and government stakeholders to embed security into the development lifecycle while keeping pace with rapid software delivery.

WHAT YOU'LL DO

• Lead the development, submission, and management of all government cybersecurity authorization artifacts within eMASS, including System Security Plans (SSPs), Security Assessment Reports (SARs), and supporting documentation required for Authority to Operate (ATO)
• Serve as the program Information System Security Manager (ISSM), maintaining continuous monitoring activities and ensuring compliance with Risk Management Framework (RMF) requirements
• Develop, implement, and enforce cybersecurity standard operating procedures across the program, ensuring engineering teams adhere to security policies throughout the software development lifecycle
• Pull, tailor, and validate Security Technical Implementation Guides (STIGs) applicable to program systems, coordinating remediation efforts with development teams
• Manage and execute application and infrastructure code scans, triaging findings and coordinating remediation with engineering
• Create, track, and manage Plans of Action and Milestones (POAMs), including risk assessments, mitigation strategies, and closure activities
• Advise program leadership on cybersecurity risk posture, emerging threats, and compliance status
• Interface directly with government cybersecurity stakeholders, Authorizing Officials (AOs), and Security Control Assessors (SCAs) throughout the accreditation lifecycle
• Collaborate with software engineers to integrate security controls into continuous integration and continuous delivery (CI/CD) pipelines

REQUIRED QUALIFICATIONS

• United States citizenship with an active Secret or Top Secret security clearance
• Minimum 5 years of experience serving as an Information System Security Officer (ISSO) or in an equivalent cybersecurity compliance role
• Minimum 3 years of hands-on experience with eMASS, including artifact creation, submission, and package management
• Demonstrated experience delivering complete RMF authorization packages through to ATO
• Strong working knowledge of NIST Special Publication 800-53, NIST 800-37, and DoD cybersecurity policies (DoDI 8510.01)
• Experience pulling, applying, and validating STIG checklists across operating systems, applications, and network devices
• Experience with vulnerability scanning and code analysis tools (for example, Nessus, ACAS, SonarQube, Fortify, or equivalent)
• Proficiency in POAM creation, management, and closure processes
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related technical discipline

PREFERRED QUALIFICATIONS

• Experience with networking, communications systems, or command and control architectures
• DoD 8570/8140 certification (for example, Security+, CISSP, CISM, CAP, or equivalent)
• Experience supporting software-intensive programs with agile or DevSecOps development methodologies
• Familiarity with container security, cloud security architectures, or zero-trust frameworks
• Prior experience supporting air defense, missile defense, or integrated battle command systems
• Experience working with cross-functional engineering teams in a fast-paced, iterative development environment
• Experience with red team, blue team, or penetration testing methodologies