RMF / A&A Analyst

Etelligent-Group-LLC; Bethesda (MD); Hybrid; USD 90,000 - 100,000; Full time

Job summary

eTel, a premier technology solutions provider to the U.S. federal government, seeks an RMF/A&A professional to map NIH FISMA systems to Zero Trust controls within the NIH OCIO program.

You will work in the Risk & Policy Pod on Task 4 and Subtasks 2.5 and 1.2, reporting to the Security Lead. Bachelor’s degree and 4+ years of federal RMF/A&A experience required.

Qualifications

• Bachelor's degree plus 4+ years of RMF/A&A in a federal environment.
• Working knowledge of NIST SP 800-37 Rev 2, 800-53 Rev 5, 800-53A, and FISMA.
• Hands-on POA&M management and experience with CSAM or a comparable GRC tool.
• Security+ or CAP/CGRC certification.
• Current T2 (BI) or higher federal background investigation, acceptable through reciprocity.

Responsibilities

• Pull the CSAM inventory and map NIH's 72 FISMA-registered systems against the Centrally Provided Services Matrix.
• Score residual gaps by FIPS 199 impact, data sensitivity, and internet exposure.
• Support the Task 4 pipeline baseline: time per phase, rework loops, inheritance vs re-documented controls.
• Build the ZTA Overlay mappings and maintain records in the NIH ZTA Wiki.
• Develop SSP, SAP/SAR, POA&M templates and continuous-monitoring cadences for three authorization tiers.
• Answer control questions routed from the ZTA help desk.

Skills

RMF/A&A

FISMA/NIST

GRC tools

Security+ CAP/CGRC

Clearance T2

Education

Bachelor's degree

Tools

CSAM

Xacta

RSA/SGRC Archer

ServiceNow

Excel

Power BI

Confluence/SharePoint

Job description

Over the past 15 years, eTel has delivered essential solutions for the federal government by securing and managing data, providing scalable identity access, modernizing legacy systems, and building high-performance platforms. By integrating new technologies and ensuring reliable operations we help agencies stay prepared for future challenges As a premier technology solutions and services company to the US federal government, eTel possesses longstanding relationships across the federal civilian marketplace. Other customers include the broader Treasury Department, Commerce Department, and State Department.

eTel offers integrated CMMI Level 3 processes, tools, and techniques with innovative, cost-efficient, and secure solutions to address complex challenges. eTel also holds ISO 9001:2015, ISO/IEC 27001:2013, and ISO/IEC 20000-1:2018 certifications, and offers dedicated subject matter experts (SMEs) and thought leaders that possess a deep understanding of customers’ environments and challenges.

Work Location and On-Site/Telework Requirements: Hybrid – NIH, Bethesda, MD. On site for A&A working sessions and pilots (typically 1–2 days/week during the first 120 days, then as scheduled).

Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.

Salary Range: $90,000-$100,000 yearly salary

Overview:

You will map NIH's FISMA systems to the Zero Trust controls they can inherit and help make Zero Trust assessable inside NIH's A&A process under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). You will work in the Risk & Policy Pod on Task 4 and Subtasks 2.5 and 1.2, reporting technically to the Security Lead.

Responsibilities:

• Pull the CSAM inventory and map the control set of each of NIH's 72 FISMA-registered systems against the Centrally Provided Services Matrix. Identify inherited, hybrid, and uncovered controls for the Inherited Controls Mapping and Remediation Roadmap (Subtask 2.5, due at 120 days, refreshed quarterly).
• Score residual gaps by FIPS 199 impact, data sensitivity, and internet exposure.
• Support the Task 4 pipeline baseline: time per phase, rework loops, inherited versus re-documented controls, and upcoming authorizations.
• Build the ZTA Overlay mappings and evidence expectations, tagging each control as central, hybrid, or system-specific. Support the CSAM import and the three-system pilot.
• Maintain records in the shared NIH ZTA control library.
• Develop package templates (SSP, SAP/SAR, POA&M) and continuous-monitoring cadences (SP 800-137) for the three authorization tiers.
• Keep the IC-inheritable controls content current on the OCIO ZTA Wiki, and answer control questions routed from the ZTA help desk.

Tools & Technology Environment: CSAM (primary), Xacta, RSA/SGRC Archer, ServiceNow; Excel and Power BI; Confluence/SharePoint and the OCIO ZTA Wiki.

Required Qualifications:

• Bachelor's degree plus 4+ years of RMF/A&A experience in a federal environment.
• Working knowledge of NIST SP 800-37 Rev 2, 800-53 Rev 5, 800-53A, and FISMA.
• Hands-on POA&M management and experience with CSAM or a comparable GRC tool.
• Security+ or CAP/CGRC certification.
• Current T2 (BI) or higher federal background investigation, acceptable through reciprocity.

Preferred Qualifications:

• HHS or NIH A&A experience in CSAM.
• Common-control and inheritance modeling; experience with Zero Trust control mapping.
• FedRAMP experience; CGRC or CISA certification.
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.

Commitment to Diversity -
eTelligent Group provides equal employment opportunities (EEO) to all applicants without regard to race, color, religion, gender, sexual orientation, gender identity, nations origin, age, disability, genetic information, marital status, amnesty, status as a covered veteran, and any other characteristic provided in accordance with applicable, federal, state and local laws.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in eTelligent Group LLC’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.