Information Systems Security Manager (ISSM)

Information Systems Security Manager

Oklo Inc. is seeking an Information Systems Security Manager (ISSM) to join our team. This role reports to the Senior Manager of IT and Cyber and is responsible for implementing, operating, and continuously improving Oklo’s information system security program. The ISSM will own the day-to-day security posture of Oklo’s information systems, ensuring confidentiality, integrity, and availability while maintaining compliance with applicable regulatory frameworks. This role bridges technical execution with compliance rigor, partnering closely with IT, engineering, legal, and compliance stakeholders. This position is ideal for someone who thrives in a fast-paced startup, enjoys building and operating security programs, and is motivated by protecting mission-critical systems that support advanced nuclear energy innovation.

Key Responsibilities

• Serve as the primary authority for the security posture of Oklo’s information systems.
• Implement, maintain, and continuously improve information system security controls in alignment with NIST 800-53 and NIST 800-171.
• Ensure security requirements are embedded into system design, configuration, and operations across on-premises and cloud environments.
• Implement, assess, and remediate system configurations against security baselines and hardening standards, including DISA STIGs and CIS Benchmarks.
• Partner with IT and engineering teams to ensure secure architectures, access controls, encryption, and monitoring.
• Oversee system-level security monitoring, logging, and alerting to detect and respond to security events.
• Lead incident response activities, including investigation, containment, remediation, and post-incident reviews.
• Coordinate vulnerability management activities, including scanning, remediation tracking, and validation.
• Ensure timely application of security patches and configuration hardening across systems and platforms.
• Own execution of security compliance activities related to various standards and contract requirements such as SOX, NIST and CMMC.
• Build, Create and Maintain System Security Plans (SSPs), policies, procedures, and supporting security artifacts.
• Conduct system risk assessments and track risks through mitigation, acceptance, or remediation.
• Support internal and external audits and assessments, ensuring evidence readiness and corrective action tracking.
• Enforce controls related to export-controlled data (DOE ECI), including access restrictions, segmentation, and secure data handling.
• Develop, maintain, and enforce information security policies, standards, and procedures.
• Ensure security documentation is accurate, current, and aligned with operational reality.
• Provide clear, actionable guidance to system owners and users regarding security responsibilities and expectations.
• Act as a trusted advisor to the Senior Manager of IT and Cyber on system security risks, gaps, and improvement opportunities.
• Partner with engineering, operations, and compliance teams to balance security, usability, and innovation.
• Communicate security risks, decisions, and requirements effectively to both technical and non-technical stakeholders.

Minimum Qualifications

• 6+ years of experience in information security or cybersecurity, with 3+ years in a system security, security engineering, or compliance-focused role.
• Proven experience applying, remediating, and maintaining compliance with security configuration frameworks such as DISA STIGs and CIS Benchmarks.
• Proven operational experience securing and maintaining systems across Linux, macOS, and Windows environments, with Linux as the primary operating system.
• Demonstrated experience implementing or operating security controls under NIST frameworks.
• Experience using automated or semi-automated compliance tooling to assess and remediate STIG or CIS controls.
• Prior experience supporting federally regulated environments, including DOE, NRC, DoD, or similar regulatory bodies.
• Active certification meeting DoD 8570 / DoD 8140 baseline requirements (e.g., CISSP, CISM, CASP+, GSEC, Security+).
• Must be considered a “U.S. Person” under 8 U.S.C. 1324b(a)(3).

Competencies

• Strong working knowledge of NIST 800-53, NIST 800-171, and risk-based security control implementation.
• Demonstrated hands-on experience remediating systems using DISA STIGs and CIS Benchmarks.
• Strong proficiency across operating systems, with hands-on experience in Linux (primary), macOS (secondary), and Windows (tertiary) environments.
• Experience supporting regulated environments (DOE, DoD, NRC, etc.).
• Ability to translate regulatory requirements into practical, operational security controls.
• Proven experience leading incident response and vulnerability remediation efforts.
• Excellent written and verbal communication skills.
• Strong organizational and time-management skills.
• Comfortable operating in a fast-paced, highly iterative startup environment.
• Curious, adaptable, and willing to propose creative and novel solutions to security challenges.
• An excellent writer who communicates clearly in a modern, active voice.
• Passionate about clean energy and making advanced fission a reality.

Who you are

• A startup person: You aren't driven by titles or hierarchy, and prefer efficiency to excess process.
• Motivated: You are self-motivated and bring enthusiasm to the team.
• A team-player: You work collaboratively and are not about taking credit or pushing blame.
• An excellent communicator: You are technically competent and a clear, upbeat communicator.
• Creative: You can identify and invent solutions to problems.
• Detail-oriented: You focus on excellence, consistency, and quality.

Travel Requirements

Remote employees are required to travel to headquarters (Santa Clara, CA) twice a quarter, with mandatory in-person attendance for the first two weeks of onboarding.

Key Skills/Competency

• Information Security
• Cybersecurity
• NIST 800-53
• NIST 800-171
• DISA STIGs
• CIS Benchmarks
• Incident Response
• Vulnerability Management
• Risk Management
• Compliance