RMF Cybersecurity Analyst (15.43)

OCT Consulting, LLC • Hyattsville, MD

1d • $90,000 - $110,000 • Hybrid

About The Position

OCT Consulting is seeking an RMF Cybersecurity Analyst to support a federal client. The analyst will work with the Information Systems Security Officer / Systems Security and Privacy Officer (ISSO/SSPO) to manage Risk Management Framework (RMF) compliance, Security Assessment and Authorization (SA&A) activities, and information security governance within a complex federal health statistics environment. This role is contingent upon contract award. The position requires supporting various SA&A activities, developing and tracking Plans of Action and Milestones (POA&Ms), preparing and maintaining System Security Plans (SSPs) and Risk Assessment Reports (RARs), and supporting FISMA reporting. The analyst will also assist with Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs), prepare project management reports, develop reusable documentation, coordinate with agency stakeholders, and ensure compliance with agency security training requirements. The role also involves applying CIPSEA oversight and supporting EPLC and IT acquisition security reviews.

Requirements

• Minimum of 3–5 years of experience in federal information security, RMF implementation, or cybersecurity compliance.
• Demonstrated experience with NIST SP 800-37, 800-30, 800-53/53A, 800-60, and FIPS 199/200.
• Experience supporting FISMA compliance and reporting activities for a federal civilian agency.
• Experience developing, reviewing, and maintaining SA&A documentation artifacts (SSPs, RARs, POA&Ms, Contingency Plans).
• Proficiency with Governance, Risk, and Compliance (GRC) platforms such as Archer or comparable tools.
• Strong technical writing skills sufficient to independently produce clear, accurate, and professionally formatted security and compliance documentation.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (or equivalent work experience).
• Ability to obtain a Public Trust (Moderate Risk – Level 5 or higher) background investigation; an HSPD-12/PIV card will be required for facility and network access.
• Must be a U.S. Citizen.

Nice To Haves

• Certified Information Systems Security Professional (CISSP), Certified Authorization Professional (CAP), Certified Information Security Manager (CISM), or equivalent certification.
• Experience supporting HHS or other Federal civilian agency environments.
• Experience with CIPSEA, Privacy Act compliance, and handling of sensitive health statistics data.
• Familiarity with FedRAMP authorization activities and cloud migration security governance.
• Experience with continuous monitoring programs and vulnerability remediation in federal environments.

Responsibilities

• Assist the ISSO/SSPO in interfacing with federal staff, contractors, and business partners to execute information security aspects of the agency's CIPSEA obligations, IT modernization, and cloud migration efforts.
• Support Security Assessment and Authorization (SA&A) activities including agency-hosted, contractor-hosted, cloud-hosted, and FedRAMP SA&As; assist with interpretation of regulations and policy guidance.
• Develop, track, and update Plans of Action and Milestones (POA&Ms) for identified vulnerabilities and risks; report remediation status monthly.
• Prepare and maintain System Security Plans (SSPs) in accordance with NIST SP 800-18 and NIST SP 800-53.
• Conduct and document Risk Assessment Reports (RARs) consistent with NIST SP 800-30 and applicable agency policies.
• Support FISMA reporting to the Department of Homeland Security and OMB; prepare gap reports of agency practices against evolving federal, HHS, and agency requirements.
• Assist with Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs) in accordance with HHS policy and OMB M-03-22.
• Prepare weekly project management/status reports and monthly RMF status reports for the COR and Program POC.
• Develop and maintain reusable templates, standard operating procedures (SOPs), and process documentation (e.g., SSP templates, risk assessment templates, process flow diagrams).
• Coordinate with agency Security, Business, and Technical Stewards; provide stakeholder advisory support and training as required.
• Support EPLC security reviews, IT acquisition security reviews, and security governance coordination activities.
• Assist in applying CIPSEA oversight in coordination with the agency Confidentiality Officer.
• Maintain compliance with all agency security training requirements including annual Security Awareness Training (SAT) and role-based training (RBT).

Benefits

• Medical, Dental, and Vision insurance
• Retirement savings 401K plan provided by an industry leading provider with 3% employer contributions of the employee's gross salary
• Paid Time Off and Standard Government Holidays
• Life Insurance, Short- and Long-Term disability benefits
• Training Benefits

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level