RMF Instructor- Security Control Implementation Statements

Cybervance • Washington, DC

26d • Hybrid

About The Position

Cybervance is seeking skilled instructors to deliver live virtual training for ISSOs, system owners, and security managers working on cloud, hybrid, and FedRAMP systems. The role prioritizes engaging instruction supported by practitioner-level Risk Management Framework (RMF) expertise and instructional design skills to build and refine course content.

The program includes an RMF course covering boundary definition, categorization, control allocation, assessment, authorization, and continuous monitoring, as well as three control-family courses: Identity and Access (AC, IA, PS); Detection, Response, and Recovery (AU, CA, CP); and Secure Configuration and Vulnerability Management (CM, SI, SA, SC). Courses focus on writing high-quality security control implementation statements using a Gather, Write, Verify cycle. Each course runs for one day and is offered multiple times annually.

Requirements

• Proven experience delivering engaging technical training to adult learners, preferably security or compliance professionals, in live virtual settings with hands-on labs.
• Strong facilitation skills, including leading role-plays and group exercises and adapting to mixed experience levels.
• Extensive hands-on RMF experience, such as as an ISSO, ISSM, or assessor, including writing SSPs and implementation statements and supporting systems through assessment and authorization.
• Direct experience with cloud or hybrid systems and FedRAMP packages, including boundary definition and control allocation.
• In-depth knowledge of NIST SP 800-37, SP 800-53 Rev. 5, SP 800-53A, and FIPS 199/200.
• Experience designing technical training, including writing measurable learning objectives, structuring curricula, and building hands-on labs and assessments.
• Strong technical writing skills and the ability to give constructive feedback on others' writing.

Nice To Haves

• A track record of strong learner evaluations or experience teaching certification preparation courses such as CGRC or CISSP.
• Certifications such as CGRC, CISSP, CCSP, or cloud security certifications from AWS, Azure, or Google Cloud.
• Experience as a FedRAMP 3PAO or security control assessor.
• Familiarity with Common Criteria (ISO/IEC 15408).
• Familiarity with GRC tools such as Xacta or CSAM.
• Formal instructional design training or certification, or experience applying models such as ADDIE or SAM.

Responsibilities

• Deliver engaging, hands-on live virtual labs and Essentials sessions, adapting pace and depth for audiences ranging from new ISSOs and managers to experienced practitioners.
• Facilitate mock interviews with role-players such as system owners, IT staff, auditors, and assessors; coach students through each Gather, Write, Verify cycle; and provide specific, actionable feedback on their drafts.
• Teach boundary definition for systems with cloud and SaaS components using Common Criteria concepts and FedRAMP guidance, and teach control allocation across common control providers, cloud providers, and the system.
• Teach students to write statements that identify the boundary components covered by each part, show whether controls are inherited, hybrid, or system-specific, and fill in organization-defined parameters such as who, how fast, and how often.
• Run verification exercises against simulated configurations, scans, logs, and account listings using NIST SP 800-53A methods: examine, interview, and test.
• Guide students through assessment, authorization, and change scenarios, including assessor interviews, evidence requests, POA&M entries, risk statements, AO decision briefs, and continuous monitoring plans.
• Design, develop, and refine course materials, including learning objectives, labs, simulated artifacts, and grading rubrics.

What This Job Offers

• Education Level: No Education Listed