ISCM Lead: Federal Security & Compliance Expert

K2United, LLC.; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

K2United, LLC. in Washington, DC is seeking an experienced information security professional to lead RMF and A&A activities for enterprise systems, ensuring persistent authorization and compliance across all environments.

You will coordinate with Security Engineers to track configuration data, perform security control assessments, manage POA&M lifecycles, support FISMA and FedRAMP audits, and act as the liaison for accreditation interviews and risk acceptance with the CISO.

Qualifications

• Bachelor's degree or equivalent experience in information security fields.
• 8+ years in federal or federally regulated information security compliance.
• Experience with RMF and A&A lifecycle activities under NIST SP 800-37.

Responsibilities

• Manage the RMF and A&A lifecycle activities for enterprise systems.
• Maintain and update SSPs, CMPs, and contingency plans.
• Support new/reauthorization and identify compliance gaps with risk-informed recommendations.
• Perform Security Control Assessments and testing for FedRAMP SaaS offerings using NIST SP800-53A.
• Own POA&M tracking, evidence collection, and aging risk reporting.
• Collaborate with Security Engineers to track configuration data within the GRC system.
• Conduct security impact analyses for deviations and coordinate risk acceptance with the CISO.
• Serve as liaison during audits; drive artifact collection and ensure completeness.
• Participate in accreditation interviews and provide incident response insights.
• Facilitate weekly security meetings between client units and OCISO.
• Review audit logs, patching status, and policy gap analyses against federal requirements.

Skills

RMF lifecycle ownership

A&A lifecycle management

NIST SP 800-37 familiarity

NIST SP 800-53 Rev.5 knowledge

FedRAMP/FISMA experience

Auditing liaison

GRC tool experience

Education

Bachelor's degree in information systems or related field

Tools

Xacta

eMASS

CSAM

RSA Archer

ServiceNow IRM

Job description

K2United, LLC. in Washington, DC is seeking an experienced information security professional to lead RMF and A&A activities for enterprise systems, ensuring persistent authorization and compliance across all environments.

You will coordinate with Security Engineers to track configuration data, perform security control assessments, manage POA&M lifecycles, support FISMA and FedRAMP audits, and act as the liaison for accreditation interviews and risk acceptance with the CISO.