Risk Management Framework RMF & Common Control Provider SME
About The Position
As an information security risk specialist, you will serve as the primary authoritative liaison for inheritable enterprise security controls. You will ensure foundational computing environments, cloud environments, and enterprise enclaves correctly author, validate, and publish common controls inherited by downstream tenant mission systems. The role involves authoring enterprise-level common controls, managing inheritance, liaising with downstream stakeholders, validating boundaries, coordinating assessments, and managing Plans of Action and Milestones (POA&Ms) and continuous authorization. You will support the protection of an essential federal agency's mission.
Requirements
- At least 5 years of experience implementing NIST SP 800-37 and NIST SP 800-53 security controls within a federal or DoD agency infrastructure context.
- Experience navigating and documenting risk packages in the Enterprise Mission Assurance Support Service (eMASS) registry.
- Experience auditing and defining the physical and logical security boundaries between hosting infrastructure and tenant responsibility.
- Experience creating, executing, and monitoring complex POA&Ms targeting enterprise-wide vulnerabilities affecting multiple systems.
- Ability to provide direct technical guidance to tenant System Owners and Information System Security Officers on safe inheritance of physical, operational, and technical controls.
- Ability to partner with independent Security Control Assessors to schedule, facilitate, and clear multi-tiered technical audits of shared platforms.
- Ability to drive integration of automated monitoring capabilities toward continuous authorization.
- Active TS/SCI clearance and willingness to take a polygraph exam; the posting also states TS/SCI clearance with polygraph is required.
- Bachelor's degree in Cybersecurity, Computer Engineering, Electrical Engineering, Electronics Engineering, Mathematics, or Computer Science.
- DoD 8140 or 8570 IAM Level II-compliant certification, such as Security+ CE.
Nice To Haves
- Experience supporting the Intelligence Community.
- TS/SCI clearance with a polygraph.
- DoD 8140 or 8570 IAM Level III-compliant certification, such as CISSP.
Responsibilities
- Author enterprise-level common controls.
- Manage control inheritance and liaise with downstream stakeholders.
- Validate security boundaries between hosting infrastructure and tenant systems.
- Coordinate security assessments with independent Security Control Assessors.
- Create, execute, and monitor complex POA&Ms targeting enterprise-wide vulnerabilities across multiple systems.
- Provide technical guidance to tenant System Owners and Information System Security Officers on inheriting physical, operational, and technical controls.
- Drive integration of automated monitoring capabilities to progress infrastructure toward a Continuous Authorization to Operate state.
Benefits
- Health benefits
- Life benefits
- Disability benefits
- Financial benefits
- Retirement benefits
- Paid leave
- Professional development
- Tuition assistance
- Work-life programs
- Dependent care
- Recognition awards for exceptional performance and demonstration of company values
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
