Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead

Tria Federal

21d • Remote

About The Position

Tria Federal is seeking an experienced Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead to oversee and execute cybersecurity activities supporting complex federal healthcare environments. The role leads multidisciplinary cybersecurity practitioners, manages multiple concurrent system authorization packages, and addresses technical, regulatory, and operational challenges in federal information security programs.

This hands-on leadership position combines strategic oversight with direct technical contributions. The Lead is accountable for team performance, deliverable quality, and timely execution of cybersecurity activities, applying federal cybersecurity requirements and risk-based decision-making while communicating effectively with government stakeholders, technical teams, and organizational leadership.

The role is remote for qualified candidates residing in the United States. Candidates within 50 miles of Woodlawn, Maryland, may choose to work on-site or hybrid, but on-site attendance is not required.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, or an equivalent combination of relevant education and professional experience.
• Professional experience supporting federal cybersecurity programs, including direct involvement in NIST RMF activities, FISMA compliance, and system authorization processes.
• Experience leading or coordinating cybersecurity practitioners, managing competing priorities, and ensuring quality and timely completion of technical and compliance deliverables.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53, and related federal information security requirements and guidance.
• Experience developing, reviewing, and maintaining system authorization documentation and supporting artifacts.
• Ability to evaluate technical security findings, assess organizational risk, and recommend remediation or mitigation strategies.
• Strong written and verbal communication skills, including the ability to communicate cybersecurity risks and recommendations to technical personnel, government stakeholders, and organizational leadership.
• Ability to obtain and maintain the required federal Public Trust designation or other customer-required suitability determination.
• Must reside in and be authorized to work in the United States.
• Must meet applicable federal contract residency requirements, including having resided in the United States for at least three of the preceding five years.
• Any certifications presented must be current, active, and maintained in good standing.

Nice To Haves

• Experience supporting cybersecurity, risk management, and compliance activities within large-scale Salesforce implementations, including familiarity with Salesforce security architecture, access controls, data protection, integrations, and platform-specific security considerations.
• Experience with cloud-based enterprise applications and infrastructure, particularly AWS, in federal or similarly regulated environments.
• Experience using Snyk, GitHub, Jira, and Confluence for vulnerability management, DevSecOps activities, security documentation, and remediation tracking.
• Experience supporting federal healthcare programs or other complex federal civilian information systems.
• Experience coordinating security assessments, vulnerability remediation, and continuous monitoring across multidisciplinary technical teams.
• Current, active CISSP and/or CSSLP certification issued by ISC2.
• Current, active PMP certification issued by PMI.
• AWS Certified Security – Specialty or another relevant AWS professional-level certification.

Responsibilities

• Lead and coordinate the day-to-day activities of cybersecurity practitioners supporting multiple federal information systems and authorization boundaries.
• Set priorities, assign and monitor work, and ensure cybersecurity deliverables are accurate, consistent, and completed on time.
• Provide technical direction, mentorship, and quality oversight while remaining directly involved in compliance activities.
• Coordinate with government stakeholders, system owners, technical teams, security assessors, and other program participants.
• Identify cybersecurity risks, operational challenges, and potential delivery issues; develop recommendations and coordinate resolution.
• Monitor program performance, communicate status and risks to leadership, and identify opportunities to improve effectiveness and compliance processes.
• Lead and perform RMF activities throughout the system authorization lifecycle, including categorization, control selection, implementation assessment, authorization support, and continuous monitoring.
• Oversee development, review, and maintenance of authorization packages, including SSPs, SARs, POA&Ms, risk assessments, and supporting documentation.
• Evaluate security control implementations and evidence for compliance and identify control deficiencies.
• Analyze security findings, vulnerabilities, and control weaknesses to assess mission impact, residual risk, and remediation or mitigation options.
• Coordinate preparation, review, and submission of authorization artifacts and facilitate resolution of findings or information requests from assessors and authorizing officials.
• Track authorization milestones, control deficiencies, remediation activities, and compliance obligations across assigned systems.
• Execute and coordinate continuous monitoring to assess system security posture and ongoing compliance.
• Execute, review, and interpret security and vulnerability scans, including scans integrated into DevSecOps pipelines.
• Coordinate with the DevOps Lead and technical stakeholders to prioritize, track, and validate remediation or mitigation.
• Assess security implications of system modifications, configuration changes, infrastructure updates, and new technologies.
• Evaluate security controls and risks in cloud and hybrid environments, including AWS.
• Use cybersecurity and workflow platforms to maintain authorization records, track findings, coordinate remediation, and support reporting.
• Perform hands-on technical security assessments, compliance reviews, evidence analysis, and other cybersecurity work as needed.
• Partner with the SecOps Lead to align RMF priorities, assessments, vulnerability management, and remediation with technical security objectives.
• Translate technical findings and regulatory requirements into actionable recommendations for technical and nontechnical stakeholders.
• Collaborate with government and contractor personnel to resolve security concerns and authorization challenges and support risk-based decisions.
• Improve RMF workflows, security documentation quality and consistency, and continuous monitoring effectiveness.
• Promote consistent cybersecurity practices, knowledge sharing, and professional development across the team.

Benefits

• A top-tier benefits package supporting physical, mental, and financial health and wellness.
• Opportunities to learn new skills, take on new challenges, and advance a career.
• A culture focused on inclusion, opportunity, and personal and professional growth.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior