Information Systems Security Manager US

Company Overview 

Metrea delivers effects-as-a-service to national security partners across five domains and more than a dozen mission areas—including airborne ISR, electronic warfare, secure communications, aerial refueling, special mission aviation, aerial firefighting, and advanced simulation. 

Wherever we operate, we build vertically integrated full stacks of capability—designing, building, and operating turnkey solutions that let customers scale capacity while benefiting from continuous cycles of innovation. With operators and engineers under one roof, we close the gap between lab and field—what we call connecting design with effect.  Metrea’s solutions are built for elegance: effective, efficient, and evolving. This approach enables our partners to do more with less and achieve outsized, asymmetric advantage against rapidly evolving threats.  Headquartered in Washington, DC, Metrea has facilities across the United States, the United Kingdom, Europe, and beyond. 
 
Metrea Management LLC is our global shared service providing support for the Capability Units (CU) in areas such as People, Finance, Legal, Strategy and Information Technology.

Position Summary 

The Information Systems Security Manager (ISSM) is responsible for overseeing and managing the Metrea’s cybersecurity compliance posture in alignment with various DoD regulatory requirements and industry-recognized security frameworks. This role provides subject matter expertise in the implementation, sustainment, and continuous improvement and monitoring of security controls required under the Cybersecurity Maturity Model Certification (CMMC) program, NIST Special Publications, and applicable federal cybersecurity regulations.

The ISSM ensures that information systems handling Controlled Unclassified Information (CUI) and other sensitive data meet or exceed compliance standards, including NIST SP 800-171, NIST SP 800-53, DFARS 252.204-7012, and related DoD cybersecurity mandates. The position serves as a key interface between executive leadership, program teams, IT Operations, IT Engineering and auditors to maintain certification readiness and support mission-critical secure operations.

Key responsibilities include developing and managing Metrea’s security compliance strategy, leading risk management efforts, directing security assessments, supporting incident response planning, and ensuring proper governance of cybersecurity policies and procedures. The ISSM also provides oversight of System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and internal control validation efforts to support successful audits and ongoing regulatory compliance.

The ISSM plays a critical role in protecting organizational assets, ensuring contractual compliance, and enabling secure participation in the Defense Industrial Base (DIB) through a robust and defensible cybersecurity program. 

What You’ll Do

Role and Responsibilities 

• Lead and support Metrea’s cybersecurity compliance strategy and execution for CMMC certification and ongoing sustainment requirements.
• Ensure the implementation and continuous monitoring of security controls aligned with NIST SP 800-171, NIST SP 800-53, DoD cybersecurity mandates, and applicable regulatory frameworks.
• Develop, maintain, and manage required compliance artifacts, including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and supporting documentation for audits and assessments.
• Coordinate internal and external security assessments, including readiness efforts supporting CMMC Level 1/2 evaluations.
• Oversee continuous compliance monitoring, audit preparation, corrective action tracking, and remediation efforts to maintain a defensible cybersecurity posture.
• Provide governance and oversight for enterprise cybersecurity risk management in alignment with the NIST Risk Management Framework (RMF).
• Conduct regular risk and vulnerability assessments across Metrea’s information systems, identifying and prioritizing mitigation strategies.
• Review, manage, and monitor access control requirements across the enterprise to ensure secure system authorization and enforcement.
• Support the review and management of security dashboards and monitoring tools to detect suspicious or anomalous activity.
• Actively respond to, investigate, and coordinate resolution of cybersecurity incidents in accordance with established response procedures.
• Design, enforce, and continuously improve comprehensive cybersecurity policies, procedures, standards, and guidelines.
• Support evaluation and enhancement of cybersecurity governance processes to strengthen compliance and operational resilience.
• Conduct periodic cybersecurity awareness training and routine simulations to improve organizational