Risk Management Framework (RMF) Support/Senior

Koniag Government Services•Smyrna, GA

6d•Onsite

About The Position

Koniag IT Systems, LLC, a Koniag Government Services company, is seeking an experienced Risk Management Framework (RMF) Support/Senior professional to serve as the RMF Lead supporting our government customer. The ideal candidate is a seasoned cybersecurity professional with deep expertise in the RMF process, security control assessments, and risk management within federal government environments. The successful candidate will perform dual functions as both a Team Lead and Senior Functional Expert, serving as the single point of contact for government stakeholders on all RMF-related activities. An active ADP-II/Secret clearance is required for this position. The RMF Support/Senior will serve as the RMF Lead, integrating security and risk management activities into the system development life cycle while applying a risk-based approach to security control selection and specification.

Requirements

Bachelor's Degree with an emphasis in Information Technology Security, Cybersecurity, or a related field from an accredited college or university. Extensive experience in the required discipline may serve as a substitution for the Bachelor's Degree requirement.
Minimum of 7 years of experience in the certification and accreditation process of Information Systems within the U.S. Federal Government. Without a Bachelor's Degree, a minimum of 10+ years of experience in the certification and accreditation process of Information Systems within the U.S. Federal Government is required.
Certified in accordance with most current DoW guidance as an IAM Level III.
Exceptional communication skills in English – both written and oral – with the ability to effectively communicate complex security and risk concepts to both technical and non-technical stakeholders.
In-depth knowledge and expertise across all steps of the RMF process as defined by NIST SP 800-37 and related publications.
Extensive experience conducting security control assessments and residual risk determinations.
Strong knowledge of NIST Special Publications, including SP 800-53, SP 800-53A, SP 800-30, and SP 800-137.
Experience preparing and reviewing A&A documentation packages including SSPs, SARs, POA&Ms, and Risk Assessment Reports.
Proficiency in applying a risk-based approach to security control selection and specification in compliance with applicable laws, Executive Orders, directives, policies, and regulations.
Demonstrated experience serving as a team lead or senior subject matter expert in a federal government IT security environment.
Strong understanding of the System Development Life Cycle (SDLC) and how security and risk management activities integrate throughout each phase.
Ability to act as the primary point of contact and liaison between technical teams and government stakeholders on all RMF-related matters.
Experience with continuous monitoring strategies and tools to ensure ongoing system authorization and compliance.
Active ADP-II/Secret clearance.

Nice To Haves

Experience supporting DoD or other federal agency A&A efforts using tools such as eMASS (Enterprise Mission Assurance Support Service) or similar platforms.
Familiarity with additional cybersecurity frameworks such as FISMA, FedRAMP, or CMMC.
Experience with cloud security assessments and the application of RMF within cloud environments.
IAM Level III certifications such as CISM, CISSP, or GSLC.
Knowledge of zero trust architecture principles and their application within federal environments.
Experience supporting or leading teams in a government contracting environment.
Familiarity with vulnerability management tools and techniques, including STIG compliance and SCAP scanning.

Responsibilities

Serve as the RMF Lead and primary single point of contact for the Government Task Monitor (GTM) and the Assessment & Authorization (A&A) government lead.
Perform dual functions as Team Lead and Senior Functional Expert, providing guidance, oversight, and expertise to team members supporting RMF activities.
Conduct and oversee all activities that integrate security and risk management into the system development life cycle (SDLC), ensuring alignment with applicable laws, directives, Executive Orders, policies, standards, and regulations.
Apply a risk-based approach to security control selection and specification, considering effectiveness, efficiency, and applicable constraints.
Lead and perform security control assessments and residual risk determinations across all steps of the RMF process.
Oversee the preparation, review, and maintenance of A&A documentation packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and Risk Assessment Reports.
Coordinate with system owners, information system security officers (ISSOs), and other stakeholders to ensure continuous monitoring and compliance with security requirements.
Provide expert guidance on RMF process steps including Categorize, Select, Implement, Assess, Authorize, and Monitor.
Identify and communicate security risks, recommend mitigation strategies, and support the development of risk acceptance decisions.
Ensure compliance with most current DoW guidance and other applicable federal cybersecurity frameworks and directives.
Mentor and provide technical direction to junior team members engaged in RMF and A&A activities.