Cybersecurity RMF Specialist

Description

The company needs a cybersecurity specialist to be the main regulatory and technical authority for approving mission-critical software that runs in DoD IL5 and IL6 enclaves.

You would manage the full RMF process on your own and build the body of evidence that supports cATO.

You would be the main link between platform engineers, developers, and government staff, including SCAs and AOs, making sure security principles are applied correctly in a DoD environment.

The work means handling cloud security requirements without close supervision, getting software ready for national security systems and keeping it that way.

Responsibilities

• Run the full RMF lifecycle for IL5 and IL6 systems, keeping eMASS controls, artifacts, POA&Ms, and authorization paperwork current and accurate.
• Maintain and submit ConMon materials to the DHA Cybersecurity Team: STIG checklists, architecture and network diagrams, HW/SW inventories, PPSM records, SBOMs, container image inventories, and supporting evidence.
• Organize ACAS and SAST scans and IAVA compliance work with the DHA Cybersecurity Team and platform engineers, tracking each finding until it is fixed and closed.
• Turn DISA STIG, SRG, and NIST 800-53 requirements into concrete technical tasks, work with engineers to build controls into code through IaC, and carry out control assessments.
• Act as the main cybersecurity contact for government stakeholders: support CCB and change requests, and brief DHA cyber teams and senior leaders on posture, compliance, risks, fixes, and the route to continued authorization.

Requirements

• 5+ years of relevant cybersecurity experience, focused on DoD RMF and IL5/IL6 authorizations.
• Hands-on work with DoD cloud service providers such as AWS GovCloud.
• A track record of leading coordination with government SCAs and mission partners without direction.
• Experience using eMASS and the Enterprise Mission Assurance Support Service to manage DoD system records.
• Familiarity with security scanning tools, including static and dynamic analysis.
• Experience with Jira and Confluence.
• Comfort giving briefings and presentations and running meetings with senior leaders and stakeholders.
• DoD 8140/8570 IAM Level III certification, such as CISSP, CISM, or GSLC.
• US citizenship and an active DoD Secret clearance.
• B.A. or B.S. in Information Security, Computer Science, or a related field.
• Desired: experience with the DoD Architecture Framework (DoDAF).
• Desired: experience with the Cloud Computing Security Requirements Guide (CC SRG).
• Desired: experience with the DoD DevSecOps Fundamentals Playbook.
• Desired: experience with DevSecOps platforms such as GitLab or GitHub.
• Desired: understanding of container tools such as Docker, Docker Compose, and Kubernetes.
• Desired: understanding of cATO concepts and of adding automated security testing to DevSecOps pipelines.

Conditions

Hybrid work in Northern Virginia.

Estimated pay is $120,000-$150,000, depending on experience.

Full-time, direct W2 role only; the company does not work with staffing agencies, C2C, or 1099 contractors.

EEO/AA employer; hires must verify identity, confirm US citizenship, and complete employment eligibility checks upon hire.