Risk Management Framework (RMF) Compliance Lead

Peraton; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Peraton is seeking a Risk Management Framework (RMF) Compliance Lead to drive RMF activities for federal environments. The role oversees ATO processes, ensures rigorous control implementation, and mentors a team of RMF professionals.

Responsibilities include developing SSPs, SARs, and POA&Ms, maintaining continuous monitoring, and coordinating with internal and external stakeholders to uphold compliance and security posture.

Qualifications

• Must be a U.S. Citizen with the ability to obtain and maintain the required Public Trust level clearance.
• One or more of the following relevant certifications: CISSP, CISM, CASP, CCISO, Security+, or CAP.
• Proven experience supporting Authority to Operate (ATO) authorization, maintenance, and continuous monitoring within FedRAMP High or other federal environments.
• Expertise in the Risk Management Framework (RMF), including NIST SP 800-37 and NIST SP 800-53, to ensure consistent implementation of security controls.
• In-depth knowledge of information systems security principles, methodologies, and technologies, including operational requirements and cyber threats.
• Familiarity with federal cybersecurity mandates, including FISMA and FedRAMP.
• Ability to perform thorough risk assessments, identify vulnerabilities, and provide actionable mitigation strategies aligned with organizational priorities.
• Proficient in creating, reviewing, and validating RMF deliverables, such as System Security Plans (SSPs), Security Assessment Reports (SARs), and POA&M s.
• Skilled in managing large-scale cybersecurity projects, ensuring adherence to timelines, resources, and organizational goals.

Responsibilities

• Oversee and manage the overall execution of RMF activities, ensuring adherence to principles and standards (NIST SP 800-37 and 800-53).
• Provide advanced expertise on RMF processes to ensure consistent application of security controls across all DHRA systems.
• Lead and mentor a team of RMF professionals, delivering high-quality documentation and outputs such as SSPs, SARs, and POA&Ms.
• Ensure accuracy, quality, and completeness of all RMF deliverables, driving continuous improvement and compliance.
• Act as the primary point of contact for RMF matters, facilitating communication between internal teams, leadership, and external stakeholders.
• Ensure RMF activities comply with regulations, policies, and guidelines, maintaining a secure posture.
• Oversee integration of RMF processes across the organization, identifying areas for improvement and fostering cybersecurity awareness.
• Lead ATO authorization and maintenance, including security control implementation, authorization package development, risk remediation, continuous monitoring.

Skills

RMF expertise

Risk assessment

SSP/SAR/POA&M

FedRAMP familiarity

Cybersecurity principles

Team leadership

Education

Bachelor's Degree

Master's Degree

Associates Degree

High School Diploma

Certifications: CISSP, CISM, CASP, CCISO, Security+, CAP

Job description

Basic Qualifications:

• Must be a U.S. Citizen with the ability to obtain and maintain the required Public Trust level clearance
• Bachelors Degree and 12 years, a Masters Degree and 10 years, an Associates Degree and 14 years, or a High School Diploma or equivalent and 16 years of experience
• One or more of the following relevant certifications: CISSP, CISM, CASP, CCISO, Security+, or CAP
• Proven experience supporting Authority to Operate (ATO) authorization, maintenance, and continuous monitoring within FedRAMP High or other federal environments
• Expertise in the Risk Management Framework (RMF), including NIST SP 800-37 and NIST SP 800-53, to ensure consistent implementation of security controls.
• In-depth knowledge of information systems security principles, methodologies, and technologies, including operational requirements and cyber threats.
• Familiarity with federal cybersecurity mandates, including FISMA and FedRAMP
• Ability to perform thorough risk assessments, identify vulnerabilities, and provide actionable mitigation strategies aligned with organizational priorities.
• Proficient in creating, reviewing, and validating RMF deliverables, such as System Security Plans (SSPs), Security Assessment Reports (SARs), and POA&Ms.
• Skilled in managing large-scale cybersecurity projects, ensuring adherence to timelines, resources, and organizational goals.

Peraton is seeking a Risk Management Framework (RMF) Compliance Lead. This person will be responsible for the overall management and execution of the Risk Management Framework (RMF) tasks, providing expert guidance and direction to a team of RMF professionals.

Work Location: Work Location: This is a remote position, but candidate must be willing to work during the hours of 8am - 5pm EST

What You'll Do:

• Oversee and manage the overall execution of the Risk Management Framework (RMF) activities, ensuring adherence to established principles and standards (NIST SP 800-37 and 800-53).
• Provide advanced expertise on RMF processes to ensure consistent application of security controls, policies, and procedures across all DHRA systems.
• Lead and mentor a team of RMF professionals, ensuring the delivery of high-quality documentation and outputs such as System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Ensure the accuracy, quality, and completeness of all deliverables related to the RMF process, driving continuous improvement and compliance.
• Act as the primary point of contact for all RMF-related matters, facilitating communication between internal teams, leadership, and external stakeholders.
• Ensure that all RMF activities comply with relevant regulations, policies, and guidelines, maintaining a secure operational posture.
• Oversee the integration of RMF processes across the organization, identifying areas for improvement and fostering a culture of cybersecurity awareness and compliance.
• Lead Authority to Operate (ATO) authorization and maintenance, including security control implementation, authorization package development, risk remediation, continuous monitoring