Junior Risk Management Framework Analyst

Delviom LLC.; Washington (District of Columbia); On-site; USD 90,000 - 120,000; Full time

Job summary

Delviom LLC is seeking a Junior RMF Analyst in Washington, DC to support the NIST RMF lifecycle, focusing on security control assessments and ATO activities for a federal program.

The role involves reviewing SSPs, SAPs, and SARs, evaluating controls, and documenting evidence. Onsite five days a week; TS clearance and 2+ years of cybersecurity experience are required. You will work with senior SCAs, ISSOs, and system owners to support authorization decisions.

Qualifications

• Active Top Secret clearance required.
• 2+ years in cybersecurity, RMF, security compliance, or IT security operations.
• Foundational understanding of RMF and its seven steps.
• Familiarity with NIST SP 800-53 and 800-53A procedures.
• Basic understanding of security assessment methodologies, control testing, risk analysis, and vulnerability management.

Responsibilities

• Support security control assessments per NIST SP 800-37/53/53A.
• Evaluate management, operational, technical, and privacy controls through testing and interviews.
• Review SSPs to verify control descriptions and system boundaries.
• Develop and execute SAPs, including procedures and evidence requirements.
• Document findings, control deficiencies, and risk observations in SARs.
• Review vulnerability results from scanners like Nessus/ACAS.
• Evaluate POA&Ms, remediation plans, risk ratings, and closure evidence.
• Validate control implementation through configuration reviews and audits.
• Support risk assessments, continuous monitoring, and re-assessments.
• Assist in ATO package reviews and authorization readiness.

Skills

Active TS clearance

RMF lifecycle

Security documentation

Analytical communication

Tools

NIST SP 800-53/53A procedures

eMASS

CSAM

Xacta

Job description

• Washington, DC
• Onsite
• 2+ Years of Cybersecurity Experience, Active Top Secret (TS) Required

Delviom is seeking a Junior Risk Management Framework (RMF) Analyst to support cybersecurity risk management, security control assessments, and Authorization to Operate (ATO) activities for a federal government program.

The candidate will support the complete NIST Risk Management Framework (RMF) lifecycle , with a primary focus on Security Control Assessor (SCA) responsibilities, including reviewing system security documentation, evaluating the implementation and effectiveness of security controls, conducting security assessments, validating technical and administrative evidence, identifying security weaknesses, documenting assessment findings, and supporting authorization decisions.

The role involves assisting with the development and execution of Security Assessment Plans (SAPs) , performing security control testing using NIST SP 800-53A assessment procedures, documenting results in Security Assessment Reports (SARs) , reviewing System Security Plans (SSPs), evaluating vulnerability scan results, validating Plans of Action and Milestones (POA&Ms), and supporting risk assessments, continuous monitoring, and periodic security reassessments.

The Junior RMF Analyst will work closely with senior SCAs, ISSOs, system owners, security engineers, and Authorizing Official (AO) representatives to evaluate security compliance, assess residual risks, validate remediation activities, and ensure authorization packages contain accurate, complete, and defensible security assessment evidence.

Key Responsibilities

Support security control assessments in accordance with NIST SP 800-37, NIST SP 800-53, and NIST SP 800-53A .

Assist in evaluating management, operational, technical, and privacy security controls through examination, interviews, and testing.

Review System Security Plans (SSPs) to verify control implementation descriptions, system boundaries, security responsibilities, and supporting documentation.

Assist in preparing and executing Security Assessment Plans (SAPs) , including assessment procedures, testing methods, and evidence requirements.

Document security assessment findings, control deficiencies, and risk observations in Security Assessment Reports (SARs) .

Review vulnerability assessment results from tools such as Tenable Nessus, ACAS, and other security scanning platforms .

Assist with evaluating POA&Ms , including remediation plans, risk ratings, corrective actions, and closure evidence.

Validate security control implementation through configuration reviews, policy and procedure assessments, audit log examinations, and technical evidence analysis.

Support risk assessments, security impact analyses, control inheritance reviews, and identification of residual risks.

Assist with ATO package reviews, security authorization readiness activities, and recommendations supporting authorization decisions.

Participate in continuous monitoring activities, periodic control assessments, vulnerability reviews, and remediation validation.

Maintain assessment documentation, evidence repositories, compliance tracking records, and security assessment dashboards.

Required Qualifications

Active Top Secret (TS) security clearance.

Minimum 2 years of experience in cybersecurity, information security, RMF, security compliance, or IT security operations .

Foundational understanding of the NIST Risk Management Framework (RMF) and its seven steps.

Familiarity with NIST SP 800-53 security controls and NIST SP 800-53A security assessment procedures .

Basic understanding of security assessment methodologies, control testing, risk analysis, and vulnerability management.

Knowledge of key RMF and ATO artifacts, including SSP, SAP, SAR, POA&M, Risk Assessment Report (RAR), and authorization packages .

Familiarity with access controls, configuration management, audit logging, system security, and vulnerability remediation.

Strong analytical, technical documentation, and communication skills.

Ability to work onsite in Washington, DC, five days per week.

Preferred Qualifications

CompTIA Security+, CAP/CGRC, or equivalent cybersecurity certification.

Exposure to federal security assessment and authorization activities.

Familiarity with eMASS, CSAM, Xacta, or similar GRC platforms .

Experience reviewing vulnerability scanning results and cybersecurity compliance evidence.

Understanding of FISMA, FedRAMP, NIST SP 800-30, and continuous monitoring requirements .

Basic knowledge of Windows, Linux, cloud security, network configurations, and identity and access management.

Delviom is seeking a Junior Information System Security Officer (ISSO) to support cybersecurity operations, Risk Management Framework (RMF) activities, and…

We are seeking an experienced Incident Detection / Response Manager IV – Lead to oversee enterprise cybersecurity incident detection, response, investigation…

Delviom is seeking an experienced Senior Platform Engineer to support a federal program focused on modernizing enterprise data infrastructure, cloud platforms…