Cybersecurity Engineer - RMF (Active Secret Clearance)

General Dynamics Mission Systems, Inc•Manassas, VA

1d•Onsite

About The Position

As a Cybersecurity Systems Engineer, you will own the end-to-end RMF lifecycle for Navy information systems — from categorization through authorization and continuous monitoring. You will be the primary technical authority for building, maintaining, and defending ATO packages across multiple systems simultaneously. The ideal candidate combines deep RMF expertise with systems engineering fundamentals, translates security requirements into actionable guidance, and thrives managing competing priorities in an Agile environment.

Requirements

Bachelor's degree in Engineering, or a related Science or Mathematics field, plus a minimum of 5 years of relevant experience; or Master's degree plus a minimum of 3 years of relevant experience.
Department of Defense active Secret security clearance is required.
Applicants selected will be subject to a U.S. Government security investigation and must meet eligibility requirements for access to classified information.
Due to the nature of work performed within our facilities, U.S. citizenship is required.
Candidate must be local to the office and able to work onsite.
RMF Mastery: Hands-on experience executing the full RMF lifecycle (NIST SP 800-37) from categorization (FIPS 199/CNSSI 1253) through ATO and continuous monitoring — not just familiarity, but package ownership
Control Assessment: Deep knowledge of NIST SP 800-53 Rev 4/Rev 5; ability to assess implementations, write defensible narratives, and identify gaps
STIG Implementation: Practical experience applying and verifying STIGs across OSes, network devices, databases, and applications using STIG Viewer and SCAP tools
Vulnerability Management: Proficiency with ACAS/Nessus and SCAP Compliance Checker; ability to interpret results and drive remediation
Documentation: Proven ability to produce audit-ready RMF artifacts (SSPs, SARs, SAPs, RARs, POA&Ms) that satisfy AO requirements
Stakeholder Communication: Can translate technical findings into risk-informed language for system owners, PMs, and AOs
Multi-System Management: Organizational skills to track controls, findings, and milestones across concurrent authorization efforts
Systems Engineering Foundation: Understanding of system architectures, data flows, boundaries, and how security requirements map to implementations
Works independently under limited direction across concurrent efforts
Active Secret clearance

Nice To Haves

Experience with Navy RMF implementation, including Navy-specific overlays, NAVSEA processes, and authorization workflows
Proficiency with eMASS and VRAM
Experience with DoD cloud authorization (IL4–IL6), FedRAMP reciprocity, or container security (Kubernetes/OpenShift)
Relevant certifications: Security+, CISSP, CAP, CISM, and/or AWS security certs (IAM/IAT Level II/III per DoD 8140)
Experience with DevSecOps toolchains and security gates in CI/CD pipelines
Experience supporting SCA evaluations or serving as an ISSE/ISSM
Track record of achieving ATO decisions on schedule across multiple systems

Responsibilities

Shepherd multiple Navy information systems through the full ATO lifecycle (Categorize, Select, Implement, Assess, Authorize, Monitor)
Build and maintain complete authorization packages: SSPs, SAPs, SARs, RARs, POA&Ms, architectural diagrams, HW/SW inventories, and continuous monitoring strategies
Develop, review, and maintain authorization boundary diagrams that clearly delineate system scope, data flows, interconnections, and external interfaces
Assess and validate NIST SP 800-53 security controls; write control satisfaction narratives with rigor to withstand SCA/AO scrutiny
Implement and validate STIGs across diverse system components; track findings through resolution or risk acceptance
Conduct vulnerability scans (ACAS/Nessus, SCAP), interpret results, and translate findings into remediation plans and residual risk determinations
Manage POA&M items end-to-end — creation, milestone tracking, risk characterization, and closure with evidence
Coordinate with system owners, ISSMs/ISSOs, SCAs, and AOs to adjudicate risk and achieve authorization decisions on schedule
Support continuous monitoring including periodic control assessments, ongoing authorization evidence collection, and change-impact analysis
Integrate security assessment activities into DevSecOps CI/CD pipelines where applicable