Risk Management Framework Engineer

Leidos; Seaside (OR); Hybrid; USD 87,000 - 157,000; Full time

Job summary

Leidos seeks an experienced RMF Engineer to support the Defense Manpower Data Center CyberPRIMES program. You will work with system owners, cybersecurity personnel, and government stakeholders to ensure complete, accurate RMF authorization packages across DHRA and DMDC environments in a hybrid setting at Mark Center, Alexandria, VA and the DMDC center in Seaside, CA.

This role requires an active Secret clearance, U.S.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, IT, Engineering, or a related technical discipline.
• 3+ years of relevant professional experience.
• Experience with DoD RMF or comparable federal authorization processes.
• Experience developing or maintaining cybersecurity authorization packages.
• Experience with System Security Plans, security controls, assessment artifacts, POA&Ms, and continuous monitoring.
• U.S. Citizenship and Active Secret clearance required.

Responsibilities

• Develop, review, and maintain RMF authorization packages.
• Review SSPs, system categorization, security-control selection, documentation, assessment results, and continuous monitoring.
• Maintain RMF authorization schedules, trackers, repositories, workflows, accounts, tickets, and status information.
• Maintain and update authorization packages within the Enterprise Mission Assurance Support Service (eMASS).
• Coordinate with system owners, cybersecurity personnel, technical teams, and government stakeholders to obtain required artifacts.
• Identify missing artifacts, incomplete documentation, control-implementation gaps, and issues delaying authorization.
• Provide RMF guidance to system owners and program stakeholders.
• Support ISSM/ISSO functions and continuous monitoring activities.
• Review security-control implementation and supporting evidence for completeness and accuracy.
• Support cybersecurity compliance reviews and authorization-status reporting.
• Develop and track POA&Ms through remediation and closure.
• Track ATO conditions and coordinate corrective actions.
• Perform QA reviews of RMF submissions before government review.

Skills

Technical documentation

Multitasking

Communication

Team collaboration

Analytical skills

Security clearance maintenance

Education

Bachelor’s degree in Cybersecurity, Computer Science, IT, Engineering, or related field

Tools

eMASS

SSP development

RMF tooling

Job description

Leidos is seeking an experiencedRisk Management Framework (RMF) Engineerto support theDefense Manpower Data Center (DMDC)CyberPRIMESprogram. Leidos is a major partner on the contract and will provide a substantialportionof the cybersecurity workforce supporting theDefense Human Resources Activity (DHRA)and DMDC. The RMF Engineer will support the development, maintenance, assessment, and authorization of cybersecurity packages for DHRA information systems. This position will work directly with system owners, cybersecurity personnel, and Government stakeholders to ensure authorization packages are complete, technicallyaccurate, current, and positioned to move efficiently through the Department of Defense authorization process.

Hybrid Work Locations:

Mark Center, Alexandria, Virginia

Department of Defense Center – Monterey Bay, Seaside, California

Clearance: Active Secret security clearance required at time of consideration. U.S. Citizen required.

Mission Environment

DMDC operates a large and complex Department of Defense information environment supporting personnel,manpower, identity, readiness, entitlement, and other mission-critical data and applications.CyberPRIMESsupports the cybersecurity governance and authorization activitiesrequiredtooperatethese systems securely. RMF Engineers will work across multiple authorization boundaries and coordinate with system owners,Information System Security Managers (ISSMs),Information System Security Officers (ISSOs), technical teams, assessors, and Government authorizing stakeholders. Theobjectiveis not simply tomaintaincompliance documentation. The RMF Engineer must understand the underlying system, evaluate how security controls are implemented,identifygaps that create authorization or mission risk, and help system owners move those issues to resolution.

Primary Responsibilities:

• Develop, review, andmaintaincomplete andaccurateRisk Management Framework authorization packages.
• Review and support development ofSystem Security Plans (SSPs), system categorization, security-control selection, control implementation documentation, assessment results, authorization packages, and continuous-monitoring reports.
• Maintain RMF authorization schedules, trackers, repositories, workflows, accounts, tickets, and status information.
• Maintain and update authorization packages within theEnterprise Mission Assurance Support Service (eMASS).
• Coordinate with system owners, cybersecurity personnel, technical teams, and Government stakeholders to obtain required authorization artifacts and supporting evidence.
• Identifymissing artifacts, incomplete documentation, control-implementation gaps, and other issues that may delay authorization.
• Provide RMF andeMASSguidance to system owners and other program stakeholders.
• Support Information System Security Manager and Information System Security Officer functions associated with system authorization and continuous monitoring.
• Review security-control implementation and supporting evidence for completeness, technical accuracy, and compliance with applicable requirements.
• Support cybersecurity compliance reviews and authorization-status reporting.
• Develop, review, and trackPlan of Action and Milestones (POA&M)items through remediation and closure.
• Track conditions associated with anAuthorization to Operate (ATO)and coordinate required corrective actions.
• Perform quality assurance reviews of RMF submissions before Government review or assessment.
• Support security-assessment planning, execution, documentation, and reporting.
• Support continuous authorization and continuous-monitoring activities for authorized systems.
• Assess the impact of changes in Department of Defense cybersecurity policy or authorization requirements andassistsystem owners in transitioning to new requirements.
• Perform cybersecurity risk assessments and support security testing associated with system authorization.
• Evaluate system hardening, vulnerabilities, configuration issues, and other technical security conditions that affect authorization risk.
• Support vulnerability and compliance remediation activities associated with RMF findings and Plan of Action and Milestones items.
• Troubleshoot cybersecurity compliance and authorization issues requiring coordination across system owners, engineers, administrators, cybersecurity teams, and Government stakeholders.
• Provide clear status, risk, and technical information to Government leadershipregardingauthorization progress, deficiencies, and actionsrequiredfor resolution.

Basic Qualifications:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and3 or more years of relevant professional experience. Specific experience, education and training may be considered in lieu of degree.
• Experience supporting the Department of Defense Risk Management Framework or comparable Federal system authorization processes.
• Experience developing, reviewing, ormaintainingcybersecurity authorization packages.
• Experience working with System Security Plans, security controls, assessment artifacts, Plans of Action and Milestones, or continuous-monitoring documentation.
• Experience assessing security-control implementation and supporting technical evidence.
• Experienceidentifyingauthorization-package deficiencies and coordinating corrective actions with system owners and technical teams.
• Experience supporting cybersecurity risk assessment, security testing, vulnerability analysis, system hardening, or compliance activities.
• Strong technical documentation, organizational, and analytical skills.
• Ability to manage multiple authorization activities, schedules, findings, and dependencies simultaneously.
• Ability to work effectively with system owners, engineers, cybersecurity personnel, assessors, and Government stakeholders.
• U.S. Citizenshiprequired.
• Active Secret security clearance required.

Preferred Qualifications:

• Experience supporting Department of Defense system authorization and continuous-monitoring programs.
• Hands-on experience with Enterprise Mission Assurance Support Service.
• Experience supporting Information System Security Manager or Information System Security Officer functions.
• Experience developing or reviewing System Security Plans and security-control implementation statements.
• Experience managing Plans of Action and Milestones and authorization conditions through closure.
• Experience supporting security-control assessments, authorization decisions, and continuous authorization.
• Experience assessing vulnerabilities, security configurations, and technical findings within an RMF authorization context.
• Experience performing quality assurance reviews of authorization packages before Government submission.
• Experience supporting multiple systems or authorization boundaries concurrently.
• Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments.

Pay Range:

Pay Range $87,100.00 - $157,450.00

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.