Risk Management Framework Engineer

Via Logic LLC; Seaside (CA); Hybrid; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking an experienced RMF Engineer to support the DMDC CyberPRIMES program. The role involves developing, maintaining, and assessing RMF authorization packages for DHRA information systems, working with system owners, ISSMs/ISSOs, and government stakeholders to ensure timely, accurate authorizations.

The position requires active Secret clearance, U.S. citizenship, and collaboration across multiple authorization boundaries.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline; 3+ years of relevant experience.
• Experience supporting the Department of Defense RMF or comparable federal authorization processes.
• Experience developing, reviewing, or maintaining cybersecurity authorization packages.
• Experience with SSPs, security controls, assessment artifacts, POA&Ms, or continuous-monitoring documentation.
• Experience assessing security-control implementation and supporting technical evidence.
• Experience coordinating corrective actions with system owners and technical teams.
• Experience risk assessment, security testing, vulnerability analysis, or compliance activities.
• Strong documentation, organizational, and analytical skills.

Responsibilities

• Develop, review, and maintain RMF authorization packages.
• Review and support development of System Security Plans (SSPs) and related artifacts.
• Maintain RMF schedules, trackers, repositories, workflows, accounts, tickets, and status information.
• Coordinate with system owners, cybersecurity personnel, and Government stakeholders to obtain artifacts.
• Identify missing artifacts, documentation gaps, and issues delaying authorization.
• Provide RMF and eMASS guidance to stakeholders.
• Support ISMs and ISSOs in system authorization and continuous monitoring.
• Review security-control implementation for completeness and accuracy.
• Support cybersecurity compliance reviews and status reporting.
• Develop, review, and track POA&M items through remediation and closure.
• Track ATO conditions and coordinate required corrective actions.
• Perform QA reviews of RMF submissions before government review.
• Support security-assessment planning, execution, and reporting.
• Assess changes in DoD cybersecurity policy and assist transitions to new requirements.
• Perform cybersecurity risk assessments and security testing for authorization.
• Evaluate system hardening, vulnerabilities, and configuration issues.
• Support remediation activities for RMF findings and POA&Ms.
• Troubleshoot compliance and authorization issues with stakeholders.
• Provide clear status and risk information to leadership on authorization progress.

Skills

Strong analytical skills

Strong technical documentation

Education

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline

Tools

System Security Plans (SSPs)

eMASS

POA&M

Job description

Leidos is seeking an experienced Risk Management Framework (RMF) Engineer to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The RMF Engineer will support the development, maintenance, assessment, and authorization of cybersecurity packages for DHRA information systems. This position will work directly with system owners, cybersecurity personnel, and Government stakeholders to ensure authorization packages are complete, technically accurate, current, and positioned to move efficiently through the Department of Defense authorization process.

Hybrid Work Locations:

• Mark Center, Alexandria, Virginia
• Department of Defense Center - Monterey Bay, Seaside, California

Clearance:

Active Secret security clearance required at time of consideration. U.S. Citizen required.

Mission Environment

DMDC operates a large and complex Department of Defense information environment supporting personnel, manpower, identity, readiness, entitlement, and other mission‑critical data and applications. CyberPRIMES supports the cybersecurity governance and authorization activities required to operate these systems securely. RMF Engineers will work across multiple authorization boundaries and coordinate with system owners, Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), technical teams, assessors, and Government authorizing stakeholders. The objective is not simply to maintain compliance documentation. The RMF Engineer must understand the underlying system, evaluate how security controls are implemented, identify gaps that create authorization or mission risk, and help system owners move those issues to resolution.

Primary Responsibilities

• Develop, review, and maintain complete and accurate Risk Management Framework authorization packages.
• Review and support development of System Security Plans (SSPs), system categorization, security‑control selection, control implementation documentation, assessment results, authorization packages, and continuous‑monitoring reports.
• Maintain RMF authorization schedules, trackers, repositories, workflows, accounts, tickets, and status information.
• Maintain and update authorization packages within the Enterprise Mission Assurance Support Service (eMASS).
• Coordinate with system owners, cybersecurity personnel, technical teams, and Government stakeholders to obtain required authorization artifacts and supporting evidence.
• Identify missing artifacts, incomplete documentation, control‑implementation gaps, and other issues that may delay authorization.
• Provide RMF and eMASS guidance to system owners and other program stakeholders.
• Support Information System Security Manager and Information System Security Officer functions associated with system authorization and continuous monitoring.
• Review security‑control implementation and supporting evidence for completeness, technical accuracy, and compliance with applicable requirements.
• Support cybersecurity compliance reviews and authorization‑status reporting.
• Develop, review, and track Plan of Action and Milestones (POA&M) items through remediation and closure.
• Track conditions associated with an Authorization to Operate (ATO) and coordinate required corrective actions.
• Perform quality assurance reviews of RMF submissions before Government review or assessment.
• Support security‑assessment planning, execution, documentation, and reporting.
• Support continuous authorization and continuous‑monitoring activities for authorized systems.
• Assess the impact of changes in Department of Defense cybersecurity policy or authorization requirements and assist system owners in transitioning to new requirements.
• Perform cybersecurity risk assessments and support security testing associated with system authorization.
• Evaluate system hardening, vulnerabilities, configuration issues, and other technical security conditions that affect authorization risk.
• Support vulnerability and compliance remediation activities associated with RMF findings and Plan of Action and Milestones items.
• Troubleshoot cybersecurity compliance and authorization issues requiring coordination across system owners, engineers, administrators, cybersecurity teams, and Government stakeholders.
• Provide clear status, risk, and technical information to Government leadership regarding authorization progress, deficiencies, and actions required for resolution.

Basic Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and 3 or more years of relevant professional experience. Specific experience, education and training may be considered in lieu of degree.
• Experience supporting the Department of Defense Risk Management Framework or comparable Federal system authorization processes.
• Experience developing, reviewing, or maintaining cybersecurity authorization packages.
• Experience working with System Security Plans, security controls, assessment artifacts, Plans of Action and Milestones, or continuous‑monitoring documentation.
• Experience assessing security‑control implementation and supporting technical evidence.
• Experience identifying authorization‑package deficiencies and coordinating corrective actions with system owners and technical teams.
• Experience supporting cybersecurity risk assessment, security testing, vulnerability analysis, system hardening, or compliance activities.
• Strong technical documentation, organizational, and analytical skills.
• Ability to manage multiple authorization activities, schedules, findings, and dependencies simultaneously.
• Ability to work effectively with system owners, engineers, cybersecurity personnel, assessors, and Government stakeholders.
• U.S. Citizenship required.
• Active Secret security clearance required.

Preferred Qualifications

• Experience supporting Department of Defense system authorization and continuous‑monitoring programs.
• Hands‑on experience with Enterprise Mission Assurance Support Service.
• Experience supporting Information System Security Manager or Information System Security Officer functions.
• Experience developing or reviewing System Security Plans and security‑control implementation statements.
• Experience managing Plans of Action and Milestones and authorization conditions through closure.
• Experience supporting security‑control assessments, authorization decisions, and continuous authorization.
• Experience assessing vulnerabilities, security configurations, and technical findings within an RMF authorization context.
• Experience performing quality assurance reviews of authorization packages before Government submission.
• Experience supporting multiple systems or authorization boundaries concurrently.
• Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.

Original Posting:

September 2, 2026

Pay Range:

Pay Range $87,100.00 - $157,450.00

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment‑related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system - never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment‑related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [e-mail].

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.

#Remote