Junior RMF Analyst — Federal Cybersecurity (Onsite DC)

Delviom LLC.; Washington (District of Columbia); On-site; USD 90,000 - 120,000; Full time

Job summary

Delviom LLC is seeking a Junior RMF Analyst in Washington, DC to support the NIST RMF lifecycle, focusing on security control assessments and ATO activities for a federal program.

The role involves reviewing SSPs, SAPs, and SARs, evaluating controls, and documenting evidence. Onsite five days a week; TS clearance and 2+ years of cybersecurity experience are required. You will work with senior SCAs, ISSOs, and system owners to support authorization decisions.

Qualifications

• Active Top Secret clearance required.
• 2+ years in cybersecurity, RMF, security compliance, or IT security operations.
• Foundational understanding of RMF and its seven steps.
• Familiarity with NIST SP 800-53 and 800-53A procedures.
• Basic understanding of security assessment methodologies, control testing, risk analysis, and vulnerability management.

Responsibilities

• Support security control assessments per NIST SP 800-37/53/53A.
• Evaluate management, operational, technical, and privacy controls through testing and interviews.
• Review SSPs to verify control descriptions and system boundaries.
• Develop and execute SAPs, including procedures and evidence requirements.
• Document findings, control deficiencies, and risk observations in SARs.
• Review vulnerability results from scanners like Nessus/ACAS.
• Evaluate POA&Ms, remediation plans, risk ratings, and closure evidence.
• Validate control implementation through configuration reviews and audits.
• Support risk assessments, continuous monitoring, and re-assessments.
• Assist in ATO package reviews and authorization readiness.

Skills

Active TS clearance

RMF lifecycle

Security documentation

Analytical communication

Tools

NIST SP 800-53/53A procedures

eMASS

CSAM

Xacta

Job description

Delviom LLC is seeking a Junior RMF Analyst in Washington, DC to support the NIST RMF lifecycle, focusing on security control assessments and ATO activities for a federal program.

The role involves reviewing SSPs, SAPs, and SARs, evaluating controls, and documenting evidence. Onsite five days a week; TS clearance and 2+ years of cybersecurity experience are required. You will work with senior SCAs, ISSOs, and system owners to support authorization decisions.