Cybersecurity Engineer / RMF Specialist

Agile Defense • Columbus, OH

1d • Onsite

About The Position

Agile Defense is hiring a Cybersecurity Risk Management Framework (RMF) Specialist to support a federal customer in documenting, assessing, and strengthening the security posture of building and facility control systems, including building automation, utilities, and metering. The role supports the customer’s efforts to achieve and maintain an Authority to Operate (ATO). It is a documentation- and assessment-focused position on a small onsite cyber team, working closely with the Cyber Systems Administrator, the government’s remote cybersecurity organization, system owners, and engineering staff. The specialist gathers and validates information, prepares clear and defensible RMF artifacts, and maintains accurate documentation as the environment changes.

The role requires hands-on RMF support in a federal, DoD, or similarly complex environment, along with experience creating security artifacts reviewed by government security or authorization personnel. A bachelor’s degree is not required; relevant experience, technical training, industry certifications, military service, or non-traditional career paths may be considered. The position is onsite in Columbus, Ohio. Applicants must be U.S. citizens able to obtain and maintain a Secret security clearance, meet DoD 8140.03 IAM Level I certification requirements such as Security+ CE, and obtain a role-based computing environment certification before privileged access within 180 days of the first day.

Requirements

• Must be a U.S. citizen and able to obtain and maintain a Secret security clearance.
• Must meet DoD 8140.03 certification requirements for the role (IAM Level I), such as Security+ CE.
• Must obtain a role-based computing environment certification before privileged access within 180 days of the first day.
• Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment.
• Experience producing security documentation and artifacts reviewed by a government ISSM, auditor, or authorizing official.
• Working knowledge of federal cybersecurity frameworks, including FIPS 199/200, NIST 800-53, NIST 800-82, and CNSSI 1253.
• Familiarity with DoD cybersecurity tools for vulnerability scanning and compliance checking, such as ACAS and SCAP, and ability to interpret their output.
• Strong written communication skills, including the ability to turn technical input from engineers and operators into clear, defensible documentation.
• Attention to detail and comfort managing multiple deliverables against overlapping deadlines.
• Ability to coordinate with program managers, remote cybersecurity stakeholders, security officers, engineers, and vendors.
• A bachelor's degree is not required; equivalent experience, technical training, or industry certifications will be considered.

Nice To Haves

• Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system.
• Experience with OT/ICS/SCADA or facility-related control systems, such as building automation or advanced metering.
• Knowledge of the Purdue Enterprise Reference Architecture.
• Experience supporting ATO or ATC efforts from start to finish.
• Familiarity with FedRAMP and Zero Trust principles.
• Experience with privacy documentation (PIA/PRiLA) or contingency plan artifacts.
• Prior DLA customer experience.

Responsibilities

• Develop and maintain RMF documentation and security artifacts, including system diagrams, categorization documents, control implementation write-ups, and plans of action.
• Collect, consolidate, and organize technical information from system owners, engineers, and operations staff into audit-ready deliverables.
• Support system categorization and risk assessment activities by preparing supporting documentation and tracking stakeholder input.
• Review vulnerability scan results and develop remediation plans (POA&Ms), tracking progress through closure.
• Assist with STIG and security control checklists, documenting compliance status and exceptions.
• Maintain accurate inventories of hardware, software, and in-scope documentation.
• Coordinate with the government’s remote cybersecurity team, program managers, and security officers to ensure artifacts meet enterprise expectations.
• Contribute to monthly reporting and recurring customer deliverables on time and in the required format.
• Support phase-in activities during ramp-up, including capturing and validating documentation from the outgoing team.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed