Risk Management Framework RMF & Common Control Provider SME

Booz Allen Hamilton • Charleston, SC

16h • $99,000 - $225,000 • Onsite

About The Position

As an information security risk specialist, you will serve as the primary authoritative liaison for inheritable enterprise security controls. You will ensure foundational computing environments, cloud environments, and enterprise enclaves correctly author, validate, and publish common controls inherited by downstream tenant mission systems. You will author enterprise-level common controls, manage inheritance, liaise with downstream stakeholders, validate boundaries, coordinate assessments, and manage Plans of Action and Milestones (POA&Ms) and continuous authorization. The role supports protection of an essential federal agency's mission.

Requirements

• At least 5 years of experience implementing NIST SP 800-37 and NIST SP 800-53 security controls within a federal or DoD agency infrastructure context.
• Experience navigating and documenting risk packages in the Enterprise Mission Assurance Support Service (eMASS) registry.
• Experience auditing and defining physical and logical security boundaries between hosting infrastructure and tenant responsibilities.
• Experience creating, executing, and monitoring complex POA&Ms targeting enterprise-wide vulnerabilities affecting multiple systems.
• Ability to provide direct technical guidance to tenant System Owners and Information System Security Officers on safe inheritance of physical, operational, and technical controls.
• Ability to partner with independent Security Control Assessors to schedule, facilitate, and clear multi-tiered technical audits of shared platforms.
• Ability to drive integration of automated monitoring capabilities to progress infrastructure toward a Continuous Authorization to Operate state.
• Active TS/SCI clearance and willingness to take a polygraph exam; the posting states TS/SCI clearance with polygraph is required.
• Bachelor’s degree in Cybersecurity, Computer Engineering, Electrical Engineering, Electronics Engineering, Mathematics, or Computer Science.
• DoD 8140 or 8570 IAM Level II compliant certification, such as Security+ CE.

Nice To Haves

• Experience supporting the Intelligence Community.
• TS/SCI clearance with a polygraph.
• DoD 8140 or 8570 IAM Level III compliant certification, such as CISSP.

Responsibilities

• Serve as the primary authoritative liaison for inheritable enterprise security controls.
• Ensure foundational computing environments, cloud environments, and enterprise enclaves correctly author, validate, and publish common controls inherited by downstream tenant mission systems.
• Author enterprise-level common controls and manage their inheritance.
• Liaise with downstream stakeholders and advise tenant System Owners and Information System Security Officers on inheriting physical, operational, and technical controls.
• Audit and define the physical and logical security boundaries between hosting infrastructure and tenant responsibilities.
• Create, execute, and monitor complex POA&Ms for enterprise-wide vulnerabilities affecting multiple systems.
• Partner with independent Security Control Assessors to schedule, facilitate, and clear multi-tiered technical audits of shared platforms.
• Drive integration of automated monitoring capabilities to move infrastructure toward Continuous Authorization to Operate (cATO).
• Coordinate assessments and support continuous authorization.

Benefits

• Health, life, and disability benefits.
• Financial and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior