RMF/ATO Analyst

Agil3 Technology Solutions (A3T)•Quantico Base, VA

3d•$100,000 - $115,000

About The Position

Agil3 Technology Solutions (A3T) is seeking an experienced Risk Management Framework (RMF) / Authorization to Operate (ATO) Analyst to support cybersecurity authorization, compliance, documentation, and continuous monitoring activities for the U.S. Government. The RMF/ATO Analyst will support the development, maintenance, assessment, and management of RMF documentation and authorization packages for the customer’s information systems. The position will work closely with Government cybersecurity personnel, ISSOs/ISSMs, system owners, and A3T's cybersecurity and engineering teams to maintain system authorization and compliance throughout the system lifecycle.

Requirements

Must have 5–8+ years of cybersecurity, information assurance, RMF, ATO, or security-compliance experience.
Must have an active DoD Secret security clearance.
Must satisfy applicable DoD 8140/DCWF requirements for Work Role 722 at the Advanced proficiency level.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related discipline.
Hands-on experience supporting the DoD Risk Management Framework and system authorization processes.
Experience developing and maintaining RMF/ATO documentation and supporting artifacts.
Demonstrated experience using eMASS.
Experience with security-control implementation, assessment, documentation, and evidence collection.
Experience developing and managing POA&Ms and tracking cybersecurity findings through remediation.
Working knowledge of DoD cybersecurity policies and authorization processes.
Knowledge of NIST security controls, DISA STIGs, vulnerability-management processes, and continuous monitoring.
Ability to interpret technical cybersecurity findings and translate them into appropriate RMF documentation.
Experience coordinating with ISSOs, ISSMs, system owners, engineers, administrators, and Government cybersecurity personnel.
Strong analytical, organizational, documentation, and communication skills.

Nice To Haves

CISSP, CAP/CGRC, SecurityX/CASP+, Security+, or other certification appropriate to the assigned DCWF work role.
Extensive experience with eMASS and DoD RMF authorization packages.
Experience supporting USMC or Department of the Navy RMF processes.
Experience with NIST SP 800-53 security controls.
Familiarity with ACAS/Tenable vulnerability results and DISA STIG compliance.
Experience supporting cloud or hybrid environments, including Microsoft Azure.
Experience with Microsoft 365 security/compliance environments.
Previous USMC, Navy, DISA, or other DoD RMF/ATO experience

Responsibilities

Support implementation and execution of the DoD Risk Management Framework (RMF) for assigned information systems.
Develop, maintain, review, and update RMF and cybersecurity authorization documentation.
Support preparation and maintenance of ATO packages throughout the authorization lifecycle.
Maintain system authorization information and cybersecurity artifacts within eMASS.
Support development, review, and maintenance of system security documentation and RMF artifacts.
Coordinate security-control implementation and documentation with system owners, ISSOs/ISSMs, Systems Engineers, Network Engineers, Cloud Engineers, and Systems Administrators.
Collect, review, organize, and validate technical evidence supporting security-control implementation and assessment.
Track security-control deficiencies and support development and maintenance of Plans of Action and Milestones (POA&Ms).
Monitor POA&M corrective actions and coordinate with responsible technical personnel to obtain evidence of remediation and closure.
Support RMF control assessments, security reviews, validation activities, and authorization decisions.
Review DISA STIG, vulnerability, configuration, and cybersecurity assessment results for inclusion in authorization documentation.
Assist technical teams with interpreting RMF documentation and evidence requirements.
Support continuous monitoring activities to maintain system authorization and cybersecurity compliance.
Evaluate proposed system changes to determine potential impacts to authorization boundaries, security controls, and existing ATOs.
Maintain accurate system inventories, authorization boundaries, architecture information, control documentation, and supporting artifacts.
Coordinate authorization activities with Government cybersecurity personnel and other applicable USMC/DoD stakeholders.
Track RMF milestones, deliverables, assessment findings, authorization expiration dates, and other compliance requirements.
Support recurring cybersecurity reviews and provide RMF/ATO status information for program and Government briefings.
Assist with development and delivery of RMF-related training and guidance to technical and program personnel.
Support reauthorization activities, system modifications, technology refreshes, migrations, and system decommissioning as required.