A&A Lead

Apex Systems; Newington, Northern (VA, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Apex Systems is seeking an A&A Lead to drive RMF strategy and execution across multiple systems and enclaves. You will develop, review, and approve authorization artifacts such as SSP, SAP/SAR, POA&M, and Continuous Monitoring Strategy while managing risk statements for executive audiences.

The role requires expert RMF knowledge, hands-on control assessments against NIST SP 800-53, cloud A&A experience, and strong executive writing and briefing skills.

Qualifications

• Expert-level knowledge of RMF lifecycle and A&A documentation (SSP, SAP/SAR, POA&M, Continuous Monitoring Strategy, Risk Register).
• Hands-on control assessment and validation against NIST SP 800-53.
• Experience with cloud A&A (AWS, Azure) at various levels.
• Executive-level writing and briefing skills.

Responsibilities

• Work with the team on portfolio-level RMF strategy and execution for multiple systems and enclaves.
• Utilize technical and soft skills to manage the development, review, and approval of authorization artifacts such as SSP, SAP/SAR, POA&M, Risk Register, and Continuous Monitoring Strategy.
• Craft risk statements and decision materials in a fast-paced environment.
• Implement quality gates, metrics, and dashboards for executive communication.
• Utilize results from vulnerability scans and configuration audits to resolve findings.
• Enterprise vulnerability management using tools like ACAS/Nessus.

Skills

RMF lifecycle

A&A documentation

Control assessment

Executive briefing

Vulnerability management

Security+ readiness

Education

Security+ certification

CISM/CISSP/CCSP certification

Tools

ACAS/Nessus

RMF tooling

Job description

## Job Description# A&A Lead* Work with the team on portfolio-level RMF strategy and execution for multiple systems and enclaves.* Utilize technical and soft skills to manage the development, review, and approval of authorization artifacts such as SSP, SAP/SAR, POA&M, Risk Register, and Continuous Monitoring Strategy.* Craft risk statements and decision materials in a fast-paced environment.* Implement quality gates, metrics, and dashboards for executive communication.* Utilize results from vulnerability scans, security benchmarks, and configuration audits to resolve findings.* Expert-level knowledge of RMF lifecycle and A&A documentation (SSP, SAP/SAR, POA&M, Continuous Monitoring Strategy, Risk Register).* Mastery of RMF tooling for package management, control inheritance, workflow, and audit readiness.* Hands-on control assessment and validation against NIST SP 800-53; familiarity with related industry directives.* Enterprise vulnerability management using tools like ACAS/Nessus and configuration baselines.* Executive-level writing and briefing skills.* Security+ certification.* CISM, CISSP, or CCSP certification.* Experience with cloud A&A (AWS, Azure) at various levels.* Experience establishing Continuous Monitoring programs and dashboards; familiarity with control overlays and tailoring.