Back to search
Qualifications:
- Active TS/SCI SSBI clearance
- B.S. Computer Science, Information Technology, or a related field
- 6+ years of RMF/Cybersecurity experience
- Demonstrated experience performing ISSO, RMF, Assessment and Authorization, or security-compliance duties for federal or DoD information systems.
- Working knowledge of the full RMF lifecycle, security controls, control assessment, authorization decisions, ongoing authorization, and continuous monitoring.
- Experience developing and maintaining SSPs, RARs, POA&Ms, assessment findings, implementation evidence, inventories, and system authorization packages.
- Hands-on proficiency with eMASS and ITIPS or comparable federal authorization-management systems.
- Experience conducting vulnerability analysis, documenting risk, developing remediation plans, tracking corrective action, and validating closure evidence.
- Ability to interpret federal, DoD, and Air Force cybersecurity requirements and apply them consistently to assigned systems.
- Ability to assess security-control evidence, identify gaps or weaknesses, determine risk implications, and recommend practical corrective actions.
- Strong analytical, technical-writing, briefing, stakeholder-coordination, quality-control, and records-management skills.
- Ability to manage multiple systems, authorization actions, recurring reports, and deadlines while maintaining artifact currency and accuracy.
- Active DoD 8570 IAM Level III and DoD 8140 System Administrator certification
Duties:
- Execute and coordinate RMF lifecycle activities for assigned systems, including security categorization support, control selection, implementation, validation, authorization, and continuous monitoring.
- Apply federal, DoD, and Air Force cybersecurity policies and translate applicable requirements into system-specific implementation and evidence needs.
- Develop, update, review, and sustain authorization artifacts, including SSPs, RARs, POA&Ms, control implementation statements, assessment evidence, inventories, diagrams, and related documentation.
- Maintain complete and accurate authorization records in eMASS and ITIPS, including status, evidence, findings, milestones, and ATO expiration information.
- Coordinate security-control implementation and evidence collection with system owners, engineers, developers, database administrators, system administrators, and program offices.
- Review security controls and evidence for completeness, effectiveness, currency, consistency, and traceability; document gaps and coordinate corrective action.
- Conduct or support vulnerability assessments, risk analysis, mitigation planning, remediation tracking, validation, and residual-risk documentation.
- Create and manage POA&Ms; monitor milestones, overdue items, closure evidence, risk acceptance, and escalation conditions.
- Track and report system and portfolio vulnerability trends, remediation status, authorization health, and continuous-monitoring results.
- Prepare security-control assessment findings reports identifying weaknesses, risk levels, mission impacts, and recommended remediation strategies.
- Support preparation and quality review of authorization decision staff packages, including risk analysis, control summaries, mission impact, and recommendations for ATO, ATO with Conditions, or Denial.
- Facilitate communication among system owners, cybersecurity personnel, program offices, the ISSM, and the FM AO to resolve information-assurance issues.
- Prepare status updates, policy and guidance inputs, AO decision-support materials, and leadership briefings; participate in governance forums and technical reviews.
- Maintain system inventory and authorization-boundary information, including key points of contact, authorization status, and expiration dates.
- Evaluate cybersecurity impacts of system modifications, configuration changes, patches, updates, and production deployments; support technical validation and readiness decisions.
- Apply technical documentation governance, version control, quality control, and records traceability to all assigned work products.
- Support COOP, disaster recovery, contingency, incident, and mission-continuity activities requested by the PMO.
Learn more about this Employer on their Career Site
