Cybersecurity Engineer / RMF Specialist

Responsibilities

• Develop and maintain RMF documentation and security artifacts, including system diagrams, security categorization documents, control implementation narratives, and plans of action and milestones (POA&Ms).
• Collect, consolidate, validate, and organize technical information from system owners, engineers, and operations personnel into deliverables suitable for audits and authorizing officials.
• Support system categorization and risk assessment by preparing documentation and tracking stakeholder inputs.
• Review vulnerability scan results, document findings, develop remediation plans and POA&Ms, and track actions through closure.
• Assist with Security Technical Implementation Guide (STIG) efforts and security control checklists, including compliance status and exceptions.
• Maintain accurate inventories of in-scope hardware, software, and supporting documentation.
• Coordinate with the Government’s remote cybersecurity team, program managers, security officers, engineers, and vendors to ensure artifacts meet enterprise expectations.
• Contribute to monthly reporting and recurring customer deliverables within required deadlines and formats.
• Support phase-in and transition activities, including obtaining and validating documentation from the outgoing team.

Requirements

• US Citizenship with ability to obtain and maintain a Secret security clearance.
• Must meet DoD 8140.03 certification requirements for this role (IAM Level I), such as Security+ CE.
• Role-based computing environment certification must be obtained before privileged access, within 180 days of the first day of employment.
• Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment.
• Experience producing security documentation and artifacts reviewed by a Government ISSM, auditor, or authorizing official.
• Working knowledge of FIPS 199/200, NIST SP 800-53, NIST SP 800-82, and CNSSI 1253.
• Familiarity with DoD vulnerability scanning and compliance tools (e.g., ACAS, SCAP) and ability to interpret output.
• Ability to translate technical input into clear, defensible security documentation and coordinate with diverse stakeholders.
• Bachelor’s degree preferred but not required; equivalent experience, technical training, military service, or relevant industry certifications will be considered.

Technologies

• RMF, Security+ CE, DoD 8140.03, FIPS 199, FIPS 200, NIST SP 800-53, NIST SP 800-82, CNSSI 1253
• STIG, eMASS, ACAS, SCAP, PIA/PRiLA, eMASS or similar RMF package management system
• Purdue Enterprise Reference Architecture, FedRAMP, Zero Trust

Preferred Skills

• Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system.
• Experience with OT, ICS, SCADA, or facility-related control systems, including building automation or advanced metering.
• Knowledge of the Purdue Enterprise Reference Architecture.
• Experience supporting ATO or Authority to Connect (ATC) efforts from initiation through completion.
• Familiarity with FedRAMP and Zero Trust principles.
• Experience with privacy documentation (PIA/PRiLA) or contingency planning artifacts.
• Prior Defense Logistics Agency (DLA) customer experience.