Risk Management Framework SME

Koniag Government Services•Fort Belvoir, VA

2d•Onsite

About The Position

Tuknik Government Services, LLC, a Koniag Government Services company, is seeking an experienced Risk Management Framework (RMF) Subject Matter Expert (SME), providing technical guidance and assessment support throughout the full RMF lifecycle. This position offers the opportunity to support mission‑critical federal programs while working within a collaborative, high‑performance environment. The RMF SME will support all phases of the Risk Management Framework lifecycle. Responsibilities include developing and reviewing RMF documentation, supporting continuous monitoring, and ensuring compliance with DoD and IC cybersecurity requirements. The RMF SME will work across multiple system types and environments—including cloud and hybrid architectures—to maintain secure, compliant, and resilient systems for Koniag’s federal customers.

Requirements

Bachelor's degree (Masters Preferred) in Computer Science, Business administration, Information systems
5–12+ years of experience supporting DoD RMF, IC RMF, ISSO, SCA, or compliance roles (experience level matched to role tier).
Hands‑on experience developing and reviewing RMF artifacts.
Demonstrated track record of successful analytical projects
Experience supporting DoD and/or IC RMF frameworks
Ability to interpret vulnerability data and support remediation planning.
Strong analytical, communication, and documentation skills.
Ability to collaborate effectively with engineers, ISSOs, SCAs, leadership, and government stakeholders.
TS/SCI security clearance

Nice To Haves

Certifications such as CAP/CGRC, CCSP, or other RMF/GRC‑focused credentials.
Experience supporting cloud environments (AWS, Azure).
Experience conducting independent assessments.
Prior experience in ISSM, ISSO Lead, SCA Lead, or other leadership roles.
Experience with vulnerability scanning tools, automated compliance tools, and enterprise security platforms.
Understanding of continuous monitoring strategies and compliance reporting.

Responsibilities

Execute all six RMF steps: Categorize, Select, Implement, Assess, Authorize, and Monitor
Create, review, and maintain SSPs, SARs, SAPs, RARs, POA&Ms, contingency plans, and complete authorization packages.
Document weaknesses, assign remediation actions, and coordinate closure with technical teams.
Implement and maintain ConMon strategies, reporting, and recurring compliance reviews.
Advise system owners, engineers, and leadership on risk posture, compliance requirements, and mitigation strategies.
Support leadership with risk summaries, authorization recommendations, and program‑level reporting.
Support mission needs and evolving program requirements as assigned