Senior Cybersecurity RMF Engineer (DoD / Secret Clearance)

Creative Visions•Aberdeen, MD

3d•Onsite

About The Position

Creative Visions is seeking an experienced Senior Cybersecurity RMF Engineer to support a prospective U.S. Army cybersecurity engineering and Risk Management Framework (RMF) program at Aberdeen Proving Ground, Maryland. The selected candidate will provide hands-on cybersecurity engineering, RMF implementation, security control assessment, and continuous monitoring support for Department of Defense information systems. The role supports development, maintenance, and execution of cybersecurity authorization activities to establish and maintain Authorities to Operate (ATOs), ensuring compliance with applicable DoD cybersecurity policies, NIST standards, and federal security requirements. The position supports cybersecurity operations at Aberdeen Proving Ground. Candidates must be willing and able to work onsite as required by the Government; remote or hybrid arrangements may be considered only if authorized under the resulting contract. The work may involve classified information systems and requires adherence to applicable DoD security procedures. This position is contingent upon contract award.

Requirements

Minimum 5 years of professional experience supporting RMF lifecycle reporting and cybersecurity authorization activities.
Minimum 5 years of experience supporting hardware/software reconciliation, consistent with the PWS's combined experience requirement.
Demonstrated experience supporting DoD RMF implementation and compliance activities.
Working knowledge of NIST SP 800-37, NIST SP 800-53, and applicable DoD cybersecurity policies.
Experience developing and maintaining RMF authorization documentation, including SSPs, SARs, and POA&Ms.
Experience supporting cybersecurity risk assessments, vulnerability management, and security control evaluations.
Familiarity with DISA STIGs, security configuration baselines, and vulnerability remediation processes.
Experience supporting configuration management and hardware/software inventory reconciliation.
Experience working with Windows, Linux, and Apple operating systems.
Experience supporting classified and unclassified information systems.
Strong analytical, technical documentation, and communication skills.
CompTIA CASP+ / SecurityX or equivalent cybersecurity certification, consistent with DoD cybersecurity workforce qualification requirements.
Active Secret security clearance required at the time of application.
Must be able to maintain the required clearance and eligibility for access to DoD information systems, including SIPRNet environments, throughout contract performance.
Must be willing and able to work onsite as required by the Government.

Nice To Haves

Previous experience supporting U.S. Army or other DoD cybersecurity programs.
Experience using eMASS for RMF authorization documentation and workflow management.
Familiarity with ACAS, SCAP, STIG Viewer, and other DoD cybersecurity assessment tools.
Experience supporting SIPRNet or other classified network environments.
Experience performing security assessments across enterprise networks, servers, and cloud environments.
Familiarity with DoD Instruction 8510.01, DoD Instruction 8500.01, and Army cybersecurity regulations.
Experience supporting Security Control Assessors (SCAs), ISSOs, or ISSMs.
Additional cybersecurity certifications such as CISSP, CISM, or Security+.

Responsibilities

Execute DoD RMF lifecycle activities, including security categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
Develop, review, and maintain RMF authorization documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and supporting security artifacts.
Support ATO development, maintenance, and reauthorization activities for DoD information systems.
Conduct cybersecurity risk assessments, security control evaluations, and compliance reviews.
Assess system configurations against applicable DISA Security Technical Implementation Guides (STIGs), NIST security controls, and DoD cybersecurity requirements.
Identify, document, track, and support remediation of cybersecurity vulnerabilities and compliance deficiencies.
Perform continuous monitoring activities to maintain system security authorizations and compliance.
Support hardware and software inventory reconciliation, configuration management, and security baseline reviews.
Evaluate proposed hardware and software changes to determine potential cybersecurity risks and impacts on system authorization.
Support security control assessments, verification and validation activities, and Security Control Assessor (SCA) reviews.
Collaborate with cybersecurity architects, system administrators, network engineers, ISSOs, ISSMs, and Government stakeholders to address security requirements.
Support cybersecurity engineering activities involving Windows, Linux, and Apple operating systems.
Prepare technical reports, assessment findings, remediation recommendations, and cybersecurity compliance documentation.
Participate in technical reviews, configuration control activities, and cybersecurity planning meetings.