Role Description Koniag IT Systems, LLC, a Koniag Government Services company, is seeking an experienced Information System Security Manager (ISSM) to join a team supporting Identity, Credential, and Access Management (ICAM) solutions built on the Okta platform for our government customers. The ideal candidate is a seasoned cybersecurity professional with a strong background in information system security management, risk management frameworks, and hands-on familiarity with Okta-based identity and access management solutions in a federal environment. This individual will serve as the primary security authority for Okta-based ICAM systems, ensuring that all security requirements, compliance obligations, and risk management activities are effectively planned, implemented, and maintained. The Okta ISSM will serve as the primary information system security authority for Okta-based ICAM systems and solutions operating within a federal government environment. This individual will be responsible for managing all aspects of the information security program for assigned systems, including: - Authorization and accreditation activities - Continuous monitoring - Risk management - Security compliance Principal responsibilities will include but are not limited to: - Serve as the primary ISSM for Okta-based ICAM systems, maintaining responsibility for the overall security posture, compliance, and risk management of assigned information systems. - Lead and manage the Authority to Operate (ATO) process for Okta-based ICAM systems, including the development, maintenance, and submission of all required security documentation such as System Security Plans (SSPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), and Plans of Action and Milestones (POA&Ms). - Implement and manage the NIST Risk Management Framework (RMF) across all phases of the system lifecycle for assigned Okta-based ICAM systems, including categorization, security control selection, implementation, assessment, authorization, and continuous monitoring. - Develop, maintain, and enforce information security policies, procedures, and standards for Okta-based ICAM systems in alignment with federal requirements and organizational directives. - Conduct and oversee continuous monitoring activities, including regular security control assessments, vulnerability scans, log reviews, and security audits of Okta environments. - Review and assess Okta platform configurations, authentication policies, access controls, and integration settings to ensure alignment with security baselines and federal security standards. - Collaborate with Okta administrators and ICAM engineers to identify and remediate security vulnerabilities, misconfigurations, and compliance gaps within the Okta environment. - Manage and track POA&Ms to ensure timely and effective remediation of security findings and vulnerabilities identified through assessments, audits, and continuous monitoring activities. - Review, assess, and approve or deny change requests affecting the security posture of Okta-based ICAM systems, participating in change management processes and change control boards (CCBs) as required. - Coordinate with the Authorizing Official (AO), Information System Security Officers (ISSOs), and other security stakeholders to communicate system security status, risks, and recommendations. - Support incident response activities related to Okta-based ICAM systems, including security event investigation, containment, remediation, and after-action reporting. - Develop and deliver security awareness and training materials related to Okta ICAM security requirements and best practices for system users and administrators. - Ensure compliance with applicable federal laws, regulations, and policies, including FISMA, FedRAMP, OMB Circulars, and agency-specific security directives. - Maintain accurate and up-to-date system security documentation and artifacts within designated governance, risk, and compliance (GRC) tools. - Provide security guidance and recommendations to program managers, system owners, and technical teams on matters related to Okta ICAM security architecture and design. Qualifications - Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field from an accredited college or university; equivalent work experience may be considered in lieu of a degree. - 5+ years of experience in information system security management, cybersecurity, or a related field within a federal government IT environment. - 3+ years of experience working with the NIST Risk Management Framework (RMF) and supporting ATO processes for federal information systems. - Demonstrated familiarity with Okta or comparable identity and access management platforms. Requirements - Active Secret Clearance required. - Exceptional communication skills in English – both written and oral – with the ability to communicate complex security concepts effectively to both technical and non-technical audiences, including senior government leadership and authorizing officials. - Deep knowledge and hands-on experience implementing the NIST Risk Management Framework (RMF), including all phases from system categorization through continuous monitoring. - Demonstrated experience developing and maintaining federal security documentation, including SSPs, SARs, RARs, POA&Ms, and contingency plans. - Strong understanding of federal information security laws, regulations, and policies, including FISMA, FedRAMP, NIST SP 800-53, NIST SP 800-37, and OMB Circulars. - Familiarity with Okta platform capabilities, including SSO, MFA, Universal Directory, Lifecycle Management, and API Access Management, and the ability to assess their security configurations against established baselines. - Knowledge of ICAM frameworks and federal identity management standards, including FICAM, NIST SP 800-63, and Zero Trust Architecture principles. - Experience conducting or overseeing continuous monitoring activities, including vulnerability scanning, log analysis, and security control assessments. - Strong understanding of information security concepts including access control, authentication, encryption, audit logging, and incident response. - Experience managing and tracking POA&Ms and coordinating remediation activities with technical teams. - Ability to assess and communicate security risks, develop risk mitigation strategies, and brief findings to government stakeholders and authorizing officials. - Experience participating in change management processes and evaluating the security impact of proposed changes to information systems. - Proficiency with governance, risk, and compliance (GRC) tools such as XACTA, eMASS, or equivalent platforms. - Demonstrated ability to manage multiple priorities and work effectively in a fast-paced, team-oriented environment. Desired Skills and Competencies - Experience serving as an ISSM or ISSO for cloud-hosted or SaaS-based federal information systems, particularly those leveraging FedRAMP-authorized platforms. - Okta Certified Administrator, Okta Certified Professional, or equivalent Okta certification. - Hands-on experience administering or supporting Okta environments, including configuration review and security hardening. - Familiarity with additional ICAM platforms such as SailPoint, CyberArk, Ping Identity, or ForgeRock and their associated security considerations. - Experience supporting or leading FedRAMP authorization processes for cloud-based systems. - Knowledge of Privileged Access Management (PAM) concepts and associated security requirements. - Understanding of PIV/CAC authentication and its integration within federal ICAM architectures. - Experience with SIEM platforms and security monitoring tools for detecting and investigating identity-related security events. - Familiarity with Zero Trust Architecture implementation and its intersection with ICAM security requirements. - Certified Information Systems Security Professional (CISSP) certification. - Certified Information Security Manager (CISM) certification. - CompTIA Security+ or equivalent certification. - Experience with cloud security frameworks and the security considerations associated with AWS, Azure, or Google Cloud environments. - Familiarity with DevSecOps practices and the integration of security requirements into CI/CD pipelines involving identity services. Benefits - Competitive compensation - Extraordinary benefits package including health, dental, and vision insurance - 401K with company matching - Flexible spending accounts - Paid holidays - Three weeks paid time off - And more