Security Risk Management

Security Risk Management Engineer Jobs

2 jobs found

Today

Security Engineer - GRC Federal Frameworks

SpaceXSI Washington, DC

Washington, DC

Today

$100k - $198k/yr Full time Cloud Cmmc Controls Continuous Monitoring

Apply Now

Job Description

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) professional to help scale its security compliance program. This onsite role in Washington, DC focuses on NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 authorization processes, with an emphasis on continuous monitoring artifacts and close partnership with engineering teams to implement and validate controls.

Responsibilities

Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Framework activities.
Oversee audits, certifications, third-party assessments, and vulnerability management to support sustained compliance and operational credibility.
Design and implement risk mitigation strategies, including monitoring systems, contingency planning, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
Ensure security configurations, practices, and procedures are implemented, monitored, and maintained across the project lifecycle.
Act as a liaison between system owners, security personnel, and cross-functional teams to support communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A& A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process improvements.
Perform regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
Serve as a subject matter expert on risk, compliance, and cybersecurity matters; translate business and technical risk for leadership.
Create and present recurring reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Required Qualifications

Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
3+ years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one domain: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

Relevant Technologies

NIST Risk Management Framework (RMF)
FedRAMP
Impact Level 4/5 (IL4/IL5)
DoD Cloud Computing SRG IL5/IL6
FedRAMP Class D. (Rev. 5 / CR2026)
NIST 800-53
NIST 800-171/CMMC
Plan of Action and Milestones (POAMs)
STIGs
Risk Management Assessment and Authorization (A& A)
Continuous Monitoring

Preferred Skills and Experience

5+ years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
Strong analytical, problem-solving, organizational, and project management capabilities, including balancing innovation, oversight, and delivery from concept to launch.
Ability to evaluate control objectives with IT configurations.
Hands-on experience implementing technical controls, not solely assessing them.
Experience in the tech or AI industry, especially with startups or innovative organizations.
Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
Excellent communication and stakeholder management skills, including translating risks to leadership and influencing cross-functional teams.
Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

Benefits

Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short and long-term disability insurance
Life insurance
Various other discounts and perks

Compensation and Location

Location: Washington, DC (onsite)
Salary: USD 100,000 to 198,000 per year

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

View full job page →

8d ago

Cybersecurity Engineer / RMF Specialist

Agile Defense Columbus, OH

Columbus, OH

8d ago

Full time Cyber Risk Assessment Cyber Security Engineer Cybersecurity Tools

Apply Now

Job Description

Agile Defense is seeking a Cybersecurity Engineer / RMF Specialist to support a federal customer by documenting, assessing, and strengthening security posture of building and facility control systems through the RMF process to support ATO achievement and sustainment.

Responsibilities

Develop and maintain RMF documentation and security artifacts, including system diagrams, categorization documents, control implementation write-ups, and plans of action
Collect, consolidate, and organize technical inputs from system owners, engineers, and operations staff into audit-ready deliverables
Support system categorization and risk assessment by preparing required documentation and tracking stakeholder inputs
Review vulnerability scan results and produce remediation plans (POA&Ms), tracking items through to closure
Assist with STIG and security control checklists by documenting compliance status and exceptions
Maintain accurate inventories of in-scope hardware, software, and documentation
Coordinate with the government remote cybersecurity team, program managers, and security officers to ensure artifacts meet enterprise expectations
Provide monthly reporting and recurring customer deliverables on time and in the required format
Support ramp-up phase activities, including capturing and validating documentation from the outgoing team

Requirements

Meet DoD 8140.03 certification requirements for this role (IAM Level I), such as Security+ CE
Complete role-based computing environment certification before privileged access, within 180 days of first day
Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment
Experience producing security documentation and artifacts reviewed by a government ISSM, auditor, or authorizing official
Bachelor’s degree not required; equivalent experience, technical training, or industry certifications considered
Working knowledge of federal cybersecurity frameworks: FIPS 199/200, NIST 800-53, NIST 800-82, CNSSI 1253
Familiarity with DoD tools for vulnerability scanning and compliance checking (e.g., ACAS, SCAP) and ability to interpret output
Strong written communication to transform technical input into clear, defensible documentation
Detail-oriented with the ability to manage multiple deliverables with overlapping deadlines
Ability to coordinate with program managers, remote cybersecurity stakeholders, security officers, engineers, and vendors to gather required information
US Citizen with ability to obtain and maintain a Secret security clearance

Technologies

Cybersecurity Risk Management Framework (RMF)
DoD 8140.03
Security+ CE
FIPS 199/200
NIST 800-53, NIST 800-82
CNSSI 1253
ACAS, SCAP
STIG
eMASS
Purdue Enterprise Reference Architecture
FedRAMP
Zero Trust
PIA/PRiLA

Preferred Skills

Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system
Experience supporting OT/ICS/SCADA or facility related control systems (e.g., building automation, advanced metering)
Knowledge of the Purdue Enterprise Reference Architecture
Experience supporting ATO or ATC efforts from start to finish
Familiarity with FedRAMP and Zero Trust principles
Experience with privacy documentation (PIA/PRiLA) or contingency plan artifacts
Prior DLA customer experience

Location

Columbus, OH | Onsite

View full job page →

Security Risk Management Engineer Jobs

Security Engineer - GRC Federal Frameworks

Cybersecurity Engineer / RMF Specialist

Get Security Risk Management Engineer Jobs alerts