Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead

Federal Advisory Partners; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Remote work within US

Benefits package

Professional development

Job summary

Tria Federal is seeking an experienced Cybersecurity GRC/RMF Lead to oversee and execute federal healthcare cybersecurity activities. You will manage multi-disciplinary teams, coordinate RMF artifacts, and ensure compliance across complex environments.

The role demands hands-on leadership, strong regulatory knowledge, and the ability to communicate with government stakeholders, technical teams, and leadership. Remote work within the United States is supported.

Qualifications

• Bachelor’s degree or equivalent in cybersecurity, IT, CS, or related field.
• Experience supporting federal cybersecurity programs including RMF and FISMA.
• Ability to lead cybersecurity practitioners and manage competing priorities.
• Strong knowledge of NIST SP 800-37/800-53 and related guidance.
• Experience creating authorization documentation (SSP, SAR, POA&M).

Responsibilities

• Lead day-to-day activities of cybersecurity practitioners across multiple federal information systems.
• Set priorities, assign work, and ensure timely, high-quality deliverables.
• Provide technical direction, mentorship, and hands-on involvement in compliance activities.
• Coordinate cybersecurity activities with government stakeholders, system owners, and security assessors.
• Identify emerging risks and deliver actionable remediation recommendations.
• Monitor program performance and drive process improvements for compliance.

Skills

GRC Leadership

RMF & NIST

Stakeholder communication

Team mentorship

Vulnerability management

Education

Bachelor's degree in Cybersecurity

Equivalent education/experience

Tools

GitHub

Jira

Confluence

Snyk

AWS

Job description

Who we are:

Tria Federal delivers digital services and technology solutions that support the health and safety of veterans, service members and civilians. For two decades, federal agencies have relied on Tria companies to advance their critical missions and modernize their systems, so that they can uphold their commitment to the American people. Today, we are pushing the boundaries of possibility through partnerships and investments in artificial intelligence and emerging technologies, developing solutions for the biggest challenges that government will face tomorrow.

We are proud to employ and support military veterans who bring mission-first mindset, technical expertise, and leadership qualities that strengthen our work. Veterans, transitioning service members, and military spouses are strongly encouraged to apply.

Job Description:

We are seeking an experienced Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead to oversee and execute cybersecurity activities supporting complex federal healthcare environments. The successful candidate will demonstrate a proven ability to lead multidisciplinary cybersecurity teams, manage multiple concurrent system authorization packages, and navigate the technical, regulatory, and operational challenges associated with federal information security programs.

This position requires a hands-on leader who can balance strategic oversight with direct technical contributions, taking ownership of team performance, deliverable quality, and the timely execution of cybersecurity activities. The ideal candidate possesses strong working knowledge of federal cybersecurity requirements, sound risk-based decision-making skills, and the ability to independently identify challenges, develop actionable solutions, and communicate effectively with government stakeholders, technical teams, and organizational leadership.

Basic Requirements:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, or an equivalent combination of relevant education and professional experience.
• Demonstrated professional experience supporting federal cybersecurity programs, including direct involvement in NIST RMF activities, FISMA compliance, and system authorization processes.
• Demonstrated experience leading or coordinating cybersecurity practitioners, managing competing priorities, and ensuring the quality and timely completion of technical and compliance deliverables.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53, and related federal information security requirements and guidance.
• Experience developing, reviewing, and maintaining system authorization documentation and supporting artifacts.
• Demonstrated ability to evaluate technical security findings, assess organizational risk, and recommend appropriate remediation or mitigation strategies.
• Strong written and verbal communication skills, including the ability to communicate cybersecurity risks and recommendations to technical personnel, government stakeholders, and organizational leadership.
• Ability to obtain and maintain the required federal Public Trust designation or other customer-required suitability determination.
• Must reside in and be authorized to work in the United States.
• Must meet applicable federal contract residency requirements, including having resided in the United States for at least three of the preceding five years.

Preferred Qualifications

• Experience supporting cybersecurity, risk management, and compliance activities within large-scale Salesforce implementations, including familiarity with Salesforce security architecture, access controls, data protection, integrations, and platform-specific security considerations.
• Experience working with cloud-based enterprise applications and infrastructure, particularly Amazon Web Services (AWS), in federal or similarly regulated environments.
• Experience utilizing security and development platforms such as Snyk, GitHub, Jira, and Confluence to support vulnerability management, DevSecOps activities, security documentation, and remediation tracking.
• Experience supporting federal healthcare programs or other complex federal civilian information systems.
• Experience coordinating security assessments, vulnerability remediation, and continuous monitoring activities across multidisciplinary technical teams.

Job Responsibilities:

The following describes the primary responsibilities associated with this position. Additional duties may be assigned based on program and organizational requirements.

Cybersecurity Leadership and Program Execution

• Lead and coordinate the day-to-day activities of cybersecurity practitioners supporting multiple federal information systems and authorization boundaries.
• Establish priorities, assign and monitor work activities, and ensure cybersecurity deliverables are completed accurately, consistently, and within established timelines.
• Provide technical direction, mentorship, and quality oversight to cybersecurity personnel while maintaining direct involvement in compliance activities.
• Coordinate cybersecurity activities with government stakeholders, system owners, technical teams, security assessors, and other program participants to support mission and authorization objectives.
• Identify emerging cybersecurity risks, operational challenges, and potential delivery issues; develop actionable recommendations and coordinate timely resolution.
• Monitor cybersecurity program performance, communicate status and risks to leadership, and identify opportunities to improve operational effectiveness and compliance processes.

Governance, Risk Management, and Authorization

• Lead and perform RMF activities throughout the system authorization lifecycle, including security categorization, control selection, implementation assessment, authorization support, and continuous monitoring.
• Oversee the development, review, and maintenance of authorization packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), risk assessments, and supporting security documentation.
• Evaluate security control implementations and supporting evidence to determine compliance with applicable federal requirements and identify control deficiencies.
• Analyze security findings, vulnerabilities, and control weaknesses to assess potential mission impact, residual risk, and appropriate remediation or mitigation strategies.
• Coordinate the preparation, review, and submission of authorization artifacts and facilitate the resolution of findings or requests for additional information from security assessors and authorizing officials.
• Maintain visibility into authorization milestones, control deficiencies, remediation activities, and compliance obligations across assigned information systems.

Technical Security and Continuous Monitoring

• Execute and coordinate continuous monitoring activities to assess system security posture of federal information systems and ensure continued compliance with applicable security requirements.
• Execute, review, and interpret security and vulnerability scans, including those integrated into DevSecOps pipelines, to identify security weaknesses, assess risk, and evaluate compliance implications.
• Coordinate with the DevOps Lead and other technical stakeholders to prioritize, track, and validate remediation or mitigation activities associated with identified vulnerabilities and security control deficiencies.
• Assess the security implications of system modifications, configuration changes, infrastructure updates, and new technologies within authorized environments.
• Evaluate security controls and associated risks within cloud-based and hybrid environments, including those leveraging Amazon Web Services (AWS).
• Utilize enterprise cybersecurity and workflow management platforms to maintain authorization records, track security findings, coordinate remediation, and support reporting obligations.
• Perform hands-on technical security assessments, compliance reviews, evidence analysis, and other cybersecurity activities as required to support program objectives.

Stakeholder Engagement and Continuous Improvement

• Partner with the SecOps Lead to align RMF priorities, security assessments, vulnerability management, and remediation activities with technical security objectives, leveraging specialized expertise to resolve complex security challenges.
• Translate technical security findings and regulatory requirements into actionable recommendations appropriate for both technical and nontechnical stakeholders.
• Collaborate with government and contractor personnel to resolve security concerns, address authorization challenges, and support informed risk-based decisions.
• Identify opportunities to streamline RMF workflows, improve the consistency and quality of security documentation, and strengthen the effectiveness of continuous monitoring activities.
• Promote consistent cybersecurity practices, knowledge sharing, and professional development across the cybersecurity team.

Preferred Certifications:

Candidates possessing one or more of the following industry-recognized professional certifications will be preferred:

• Certified Information Systems Security Professional (CISSP) and/or Certified Secure Software Lifecycle Professional (CSSLP), issued by ISC2.
• Project Management Professional (PMP), issued by the Project Management Institute (PMI).
• AWS Certified Security - Specialty or other relevant AWS professional-level certifications.

All certifications must be current, active, and maintained in good standing.

Work Location:

This is a remote position open to qualified candidates residing within the United States. Candidates located within 50 miles of Woodlawn, Maryland, may elect to work on-site or in a hybrid capacity based on their individual preferences. On-site attendance is not required for this position.

Why Tria?

What defines the Tria brand is more than just our dedication to excellence in our craft; it's our incredible team of dedicated, talented, and passionate people that make Tria so exceptional. As people powering possible, we are all partners in our team's shared success.

As a company that cares about people, we seek to cultivate a culture in which all can thrive personally and professionally. We offer a top-tier benefits package to invest in your physical, mental, and financial health and wellness so that you can be your best self - at work and in life. At Tria, we are growth-minded, entrepreneurial in spirit, and committed to fostering a culture of inclusion and opportunity for all. Whatever your background, your role, your department, or stage in your professional journey, here you will have opportunities to learn new skills, seize new challenges, and advance your career as we grow.

California Consumer Privacy Act (CCPA)

We are committed to protecting your privacy. As part of our compliance with the California Consumer Privacy Act (CCPA), we want to inform you about how we collect, use, and protect your personal information during the job application process. For more details, please review https://www.oag.ca.gov/privacy/ccpa.