Remote Security Risk Engineer (RMF & Zero Trust)

Hiring Our Heroes; Arlington (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Zermount Inc. seeks an experienced System Risk Engineer to support risk analysis and ensure federal information systems meet cybersecurity standards. The role involves validating controls across cloud, on‑premise, and network environments, producing risk memos, and guiding remediation with a focus on mission assurance.

Ideal candidates have 7+ years in cybersecurity for U.S. Government systems and hands-on RMF/GRC experience, with active security focus and strong collaboration with engineering

Qualifications

• 7+ years of cybersecurity experience supporting U.S. Government systems.
• 4+ years performing RMF, ISSO, Assessment, or GRC functions with technical validation.
• Hands-on experience in two technical domains (cloud, network, systems, or databases).
• Ability to validate controls using configurations, logs, and interviews

Responsibilities

• Execute Security Assessments, Risk Assessments, and Ongoing Authorization in live environments.
• Validate security controls across OS, applications, databases, cloud, and networks.
• Identify real-world risks, including exploitable vulnerabilities and misconfigurations.
• Perform continuous risk analysis using scans, tests, logs, and configs.
• Develop risk-based findings and POA&M matrices with remediation prioritization.
• Produce SARs, risk memos, and ATO packages with evidence-backed findings.
• Provide weekly status updates with risks and mitigation progress.

Skills

Security Assessment

Risk Validation

RMF 800-37/800-53

GRC

Zero Trust

DHS/FISMA

Cloud Security

Education

Bachelor's degree in CS/IT/Cybersecurity

Security certifications (CAP/CISA/CISM/CISSP)

Tools

Tenable

Qualys

CrowdStrike

Splunk

Microsoft Sentinel

IBM QRadar

Ansible

Terraform

Puppet

Archer

ServiceNow

Job description

Zermount Inc. seeks an experienced System Risk Engineer to support risk analysis and ensure federal information systems meet cybersecurity standards. The role involves validating controls across cloud, on‑premise, and network environments, producing risk memos, and guiding remediation with a focus on mission assurance.

Ideal candidates have 7+ years in cybersecurity for U.S. Government systems and hands-on RMF/GRC experience, with active security focus and strong collaboration with engineering