Remote RMF & A&A Cybersecurity Risk Specialist

Cherokee Federal; Oregon; Hybrid; USD 130,000 - 135,000; Full time

Benefits offered by this job

401(k) match

PTO

Health, dental, vision

Life insurance

Disability insurance

Paid holidays

EAP

FSA/HSA

Professional development

Job summary

Cherokee Federal is seeking a Senior Cybersecurity A&A Risk Analyst to provide advanced governance, risk, and compliance support for federal information systems under FISMA and RMF. The role focuses on managing external service authorization activities, conducting risk assessments, and supporting continuous monitoring, with a remote, full-time setup for NSF contracts in the U.S.

You will work with system owners, ISSOs, CSPs, and program offices to ensure compliance and risk posture.

Qualifications

• Seven years of progressive cybersecurity experience with at least four in RMF/A&A.
• Experience implementing NIST RMF and FedRAMP familiarity.
• Ability to engage with system owners, ISSOs, and senior stakeholders.
• Proficiency with security documentation and incident response processes.

Responsibilities

• Manage full lifecycle RMF activities per NIST 800-37.
• Develop and maintain SSPs, SAPs, SARs, and POA&Ms.
• Review FedRAMP authorization packages and updates.
• Monitor ATO packages in the FedRAMP Secure Repository.
• Coordinate with system owners, ISSOs, CSPs, and security stakeholders.
• Evaluate controls per NIST 800-53 Rev. 5 (inherited and agency-implemented).
• Conduct risk assessments per NIST 800-30 and present findings to officials.
• Support continuous monitoring by reviewing vulnerability scans and POA&Ms.
• Perform other job-related duties as assigned.

Skills

RMF/A&A experience

NIST RMF familiarity

GRC documentation

Stakeholder engagement

Education

Bachelor's degree in Cybersecurity, IT, Public Policy, or related discipline

CISSP, CISM, or CAP certification

Job description

Cherokee Federal is seeking a Senior Cybersecurity A&A Risk Analyst to provide advanced governance, risk, and compliance support for federal information systems under FISMA and RMF. The role focuses on managing external service authorization activities, conducting risk assessments, and supporting continuous monitoring, with a remote, full-time setup for NSF contracts in the U.S.

You will work with system owners, ISSOs, CSPs, and program offices to ensure compliance and risk posture.