Army RMF Cybersecurity Engineer: STIGs, ATO & Risk

MAG Aerospace; United States; On-site; USD 100,000 - 165,000; Full time

Benefits offered by this job

Total Rewards program

Health benefits

Tuition assistance

Job summary

MAG Aerospace seeks a Cybersecurity Engineer/SME to support Army RMF activities, STIG reviews, vulnerability management, and eMASS authorization artifacts onsite at Ft. Belvoir.

The role requires an active Secret clearance, DoD/NIST knowledge, and the ability to coordinate with government and contractors to close findings and maintain compliance. You will lead assessments, maintain SSPs and POA&Ms, and advise leadership on risk and authorization impacts.

Qualifications

• Active Secret Clearance required to start.
• Security+ CE or higher DoD 8140/8570 compliant certification.
• Strong RMF experience for Army/DoD systems and continuous monitoring activities.
• Solid knowledge of AR 25-2, DoD RMF, NIST 800-53 security controls, and Army cybersecurity requirements.
• Hands-on experience reviewing DISA STIGs, CKL files, and cybersecurity compliance evidence.
• Experience developing and maintaining POA&Ms, remediation plans, risk assessments, mitigation plans, and RMF authorization artifacts.
• Ability to work independently with government personnel, assessors, engineers, software developers, cloud teams, and vendors.

Responsibilities

• Lead and support Army RMF activities for system authorization, cybersecurity compliance and continuous monitoring efforts.
• Review, analyze, and maintain DISA STIG compliance artifacts, including STIG Viewer checklists (.CKL files), supporting evidence, and remediation status.
• Execute, review, and interpret cybersecurity scans, including SCAP Compliance Checker, ACAS, vulnerability scans, and related assessment results.
• Correlate DISA STIG findings, scan results, vulnerability data, and security assessment findings to identify compliance gaps, assess risk, and establish remediation priorities.
• Develop, review, and maintain cybersecurity documentation, including System Security Plans (SSP), Cybersecurity Strategies, POA&Ms, risk assessments, mitigation plans, and RMF authorization artifacts.
• Maintain cybersecurity records and authorization package data within eMASS in support of IATT, ATO, Assess Only and Continuous Monitoring requirements.
• Coordinate with Government stakeholders, Authorizing Officials (AO), Security Control Assessors (SCA), system engineers, software developers, cloud teams, vendors, and assessors to resolve cybersecurity findings and drive remediation efforts to closure.
• Review Vendor's cybersecurity deliverables for technical adequacy, compliance, and alignment with Army and DoD cybersecurity requirements.
• Support cybersecurity test events, vulnerability assessments, penetration testing, security reviews, and authorization readiness activities.
• Evaluate cybersecurity risks and provide recommendations to program leadership regarding compliance posture, remediation status, risk acceptance, and authorization impacts.
• Support implementation of new Army and DoD cybersecurity policies, guidance, and requirements and assess impacts to the program.
• Serve as a cybersecurity advisor to program leadership and technical teams on RMF, vulnerability management, compliance, and risk management activities.

Skills

RMF for Army/DoD

DisA STIGs analysis

Vulnerability management

SCAP/ACAS analysis

Stakeholder coordination

Authorization support

Education

BS Electrical Engineering >5 years (LEVEL II)

MS Electrical Engineering or Equivalent >15 years (LEVEL III)

Tools

STIG Viewer CKL files

eMASS

SCAP Compliance Checker

Job description

MAG Aerospace seeks a Cybersecurity Engineer/SME to support Army RMF activities, STIG reviews, vulnerability management, and eMASS authorization artifacts onsite at Ft. Belvoir.

The role requires an active Secret clearance, DoD/NIST knowledge, and the ability to coordinate with government and contractors to close findings and maintain compliance. You will lead assessments, maintain SSPs and POA&Ms, and advise leadership on risk and authorization impacts.