Manager (Functional Team Lead)

About the role

The Functional Team Lead leads integrated cybersecurity and privacy support across audit and data-call response, Governance, Risk, and Compliance (GRC) tool administration, Risk Management Framework (RMF) implementation, system security status reporting, privacy program operations, workforce training, and cybersecurity policy management. This position manages a team of approximately 10 resources who support delivery across these key service areas and works closely with the senior leadership to align priorities, communicate risk, and support informed decision-making. Excellent collaboration, people-management, interpersonal, and communication skills are critical to success in this role. The role directs cross-functional activities, translates federal requirements into practical processes and documentation, and ensures accurate, accessible, audit-ready deliverables are completed on time and submitted for government approval. This role reports directly to the Program Manager and Deputy Program Manager.

What you'll do

• Manage and provide delivery oversight for a team of approximately 10 resources supporting cybersecurity audits and data calls, GRC/RMF activities, privacy operations, training, reporting, policy management, and process improvement.

• Lead cybersecurity audits and data calls from intake through submission, including requirements analysis, close collaboration with the senior leadership and other stakeholders, artifact collection and validation, quality control, risk escalation, metrics tracking, and delivery of complete, audit-ready responses.

• Administer and support Cyber Security Assessment and Management (CSAM) and any current or future selected GRC solution; register and maintain systems, sites, and programs across on-premises, cloud, and contractor environments; and manage inventories, security categorizations, System Security and Privacy Plans (SSPPs) and appendices, Plans of Action and Milestones (POA&Ms), control assessments, and RMF reporting.

• Leverage Department of Commerce (DOC) data sources, privacy documentation, and GRC data to deliver transparent, actionable System Security Status Reporting and recommendations that improve cybersecurity risk posture.

• Lead Privacy Program support within the Privacy and Continuous Monitoring Branch, including privacy-related policy development, assessments and documentation, risk management, training, reporting, stakeholder engagement, and compliance monitoring.

• Develop, deliver, maintain, and update live and on-demand cybersecurity and privacy training covering GRC tools, RMF and role-based responsibilities, privacy, Federal Risk and Authorization Management Program (FedRAMP), annual cybersecurity awareness, monthly Information System Security Officer (ISSO) topics, POA&M development, security categorization, reporting, and other government-identified needs.

• Maintain the Office of the Chief Information Security Officer (OCISO) training schedule and online resources, track compliance metrics, ensure training content meets Section 508 requirements, and coordinate with client's Digital Media Services to convert approved content into eLearning modules for learning platforms.

• Develop recommendations and draft documents for government approval, and develop, document, maintain, and update all information technology security and cybersecurity policies, procedures, handbooks, guides, and templates to incorporate and comply with the most current federal cybersecurity requirements in law, directives, policies, and guidance, including the Federal Information Security Modernization Act (FISMA), Office of Management and Budget (OMB) directives, Department of Homeland Security (DHS) Binding Operational Directives, Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), National Institute of Standards and Technology (NIST) Special Publications, and DOC policies and procedures.

• Review all information technology security and cybersecurity policies, procedures, and guides at least annually, or more frequently when federal requirements change; coordinate with agency stakeholders to obtain and incorporate their input; prepare draft updates for government approval; continuously monitor changes to applicable federal laws, directives, policies, and guidelines; and provide with a quarterly written executive summary identifying updates that should be implemented to maintain compliance.

• Collaborate with automation team and subject-matter experts to analyze, identify, and implement automation where appropriate and feasible to streamline processes and reduce manual tasks as much as possible, including implementing prompt-based document repositories.

Qualifications

• At least four years of experience supporting cybersecurity audits and data calls, including collecting, compiling, validating, submitting, and tracking information and artifacts.

• Hands-on experience administering or supporting GRC tools and RMF activities, including system inventories, security categorization, SSPPs, POA&Ms, control assessments, and reporting.

• Knowledge of federal cybersecurity and privacy requirements and frameworks, including FISMA, OMB directives, DHS Binding Operational Directives, DISA STIGs, NIST publications, FedRAMP, and agency-level policies.

• Experience developing and maintaining cybersecurity or privacy policies, procedures, guidance, templates, assessments, executive reports, and other governance documentation.

• Experience designing and delivering instructor-led and on-demand cybersecurity or privacy training, tracking compliance metrics, and producing Section 508-compliant content.

• Strong leadership, analytical, quality-assurance, project-management, technical-writing, presentation, and stakeholder-engagement skills.

• Excellent collaboration, people-management, interpersonal, and communication skills are critical to success in this role, including the ability to build trust, guide teams, resolve conflicts, and work effectively with USPTO senior leadership and cross-functional stakeholders.

• Ability to manage competing priorities, coordinate cross-functional teams, identify and escalate risk, make actionable recommendations, and deliver accurate work products under firm deadlines.

Required Certification

• CompTIA Security+

Salary Range: $110,000 - $124,000

The salary range listed for this position is based on multiple factors, including relevant years of experience, education, certifications, specialized skills, security clearance level, and overall alignment with the role’s requirements. The final compensation offered may vary based on the candidate’s qualifications and experience.