RMF/Assessment & Authorization (A&A) Analyst

Socket.dev; Bethesda (MD); On-site; USD 115,000 - 135,000; Full time

Benefits offered by this job

Certificate incentive program

PTO and floating holidays

Health and dental insurance options

401k matched

Job summary

SkyePoint Decisions is seeking an RMF/Assessment & Authorization (A&A) Analyst to support the implementation and maintenance of the RMF for information systems and applications. You will work with System Owners, ISSOs, cybersecurity teams, and Government stakeholders to ensure ATO status in compliance with Federal requirements.

The role focuses on developing and maintaining authorization documentation, assisting with security assessments, tracking remediation, and contributing to continuous

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or related field.
• Minimum 5 years of cybersecurity, information assurance, or RMF experience supporting Federal information systems.
• Experience supporting Assessment & Authorization (A&A) efforts and RMF processes.
• Familiarity with NIST RMF SP 800-37, NIST SP 800-53 Rev. 5, and FISMA.
• Experience preparing or maintaining security documentation and authorization artifacts.
• U.S. Citizenship required and ability to obtain Public Trust.

Responsibilities

• Support development, maintenance, validation, and closure tracking of POA&Ms.
• Coordinate remediation tracking activities and validate corrective-action evidence for POA&M closure.
• Coordinate with Privacy Officials on PTAs, PIAs, and privacy integration into authorization activities.
• Support RMF activities across the system development lifecycle.
• Assist with system categorization, boundary definition, and security control implementation.
• Maintain authorization documentation and supporting artifacts.
• Ensure security documentation remains current and compliant with applicable standards.
• Coordinate with stakeholders to collect and validate required security evidence.
• Develop, update, and maintain authorization package documentation.
• Assist in assembling complete authorization packages for review and approval.
• Support reauthorization and decommissioning activities.
• Participate in quality control reviews of security documentation.
• Work with ISSOs, System Owners, Security Engineers, Privacy Officials, and Program Management teams.
• Participate in authorization working groups and compliance meetings.
• Provide status updates and reporting to project leadership.
• Support cybersecurity awareness and compliance initiatives.

Skills

Analytical thinking

Organizational skills

Communication skills

Education

Bachelor's degree in Cybersecurity/Information Assurance

Tools

eMASS

Xacta

Archer

ServiceNow GRC

Cloud platforms (AWS/Azure/GCP)

Job description

SkyePoint Decisions is a leading Cybersecurity Architecture and Engineering, Critical Infrastructure and Operations, and Applications Development and Maintenance IT service provider headquartered in Dulles, Virginia with operations across the U.S. We provide innovative enterprise-wide solutions as well as targeted services addressing the complex challenges faced by our federal government clients. Our focus is on enabling our clients to deliver their mission most efficiently and effectively – anytime, anywhere, securely. We combine technical expertise, mission awareness, and an empowered workforce to produce meaningful results.

This is a contingent position based on contract win.

SkyePoint Decisions is seeking a RMF/Assessment & Authorization (A&A) Analyst tosupport the implementation and maintenance of the Risk Management Framework (RMF) for information systems and applications. The Analyst works closely with System Owners, Information System Security Officers (ISSOs), cybersecurity teams, and Government stakeholders to ensure systems achieve and maintain Authorization to Operate (ATO) status in compliance with Federal cybersecurity requirements.

The position is responsible for developing and maintaining authorization documentation, supporting security assessments, tracking remediation activities, facilitating continuous monitoring activities, and contributing to ongoing cybersecurity compliance efforts.

This position is fully remote.

Responsibilities:

• Support development, maintenance, validation, and closure tracking of Plans of Action and Milestones (POA&Ms).
• Coordinate remediation tracking activities and validate corrective-action evidence supporting POA&Ms closure recommendations.
• Coordinate with Privacy Officials to support Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), and integration of privacy requirements into authorization activities.
• Support RMF activities across the system development lifecycle.
• Assist with system categorization, boundary definition, and security control implementation efforts.
• Maintain authorization documentation and supporting artifacts.
• Ensure security documentation remains current and compliant with applicable standards.
• Coordinate with stakeholders to collect and validate required security evidence.
• Develop, update, and maintain authorization package documentation.
• Assist in assembling complete authorization packages for review and approval.
• Support reauthorization and decommissioning activities.
• Participate in quality control reviews of security documentation.
• Work closely with ISSOs, System Owners, Security Engineers, Privacy Officials, and Program Management teams.
• Participate in authorization working groups and compliance meetings.
• Provide status updates and reporting to project leadership.
• Support cybersecurity awareness and compliance initiatives.

Required Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Assurance, or related discipline.
• Minimum 5 years of cybersecurity, information assurance, or RMF experience supporting Federal information systems.
• Experience supporting Assessment & Authorization (A&A) efforts and RMF processes.
• Familiarity with: NIST Risk Management Framework (SP 800-37), NIST SP 800-53 Rev. 5, and FISMA
• Experience preparing or maintaining security documentation and authorization artifacts.
• Strong analytical, organizational, and communication skills.
• U.S. Citizenship required.
• Ability to obtain and maintain a Public Trust.

Preferred Qualifications:

• One or more of the following certifications:
  • GCIH (GIAC Certified Incident Handler)
  • ECIH (EC-Council Certified Incident Handler)
  • Security+
  • CEH
  • CySA+
  • GCFA
  • CISSP
  • OSCP
• Experience supporting HHS or other Federal civilian agencies.
• Experience using governance, risk, and compliance (GRC) platforms such as eMASS, Xacta, Archer, or ServiceNow GRC.
• Experience supporting cloud-based environments (AWS, Azure, or GCP).
• Knowledge of Zero Trust Architecture, CDM, and FedRAMP requirements.
• Experience working in a FISMA-compliant environment.

Compensation:

Salary Range: $115,000 - $135,000

The SkyePoint Decisions salary range for this position is a general guideline only. It represents an estimated range for this position and is just one piece of our total compensation package.

Salary at SkyePoint is determined by various factors, including but not limited to location, work schedule, the candidate’s combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability, market data and business considerations.

In addition to a competitive salary, SkyePoint offers benefits including a certification incentive program, PTO, floating federal holiday options, several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, Vision, ST/LT Disability, Life Insurance, and 401k matched.

What We Can Offer You:

• At SkyePoint, we go B.I.G. (beginning in GRATITUDE) by recognizing all we have and giving back to our employees, families, and communities. It instills a positive mindset that permeates all we do. By beginning in gratitude, SkyePoint can continue to spread living in gratitude each day.
• Great Benefits: Several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, ST/LT Disability, Life Insurance, floating federal holiday options, and 401k matched
• Certificate Incentive Program: To promote professional development, we recognize and reward employees who obtain new certifications aligned with business needs.
• Flexible Work Environment

SkyePoint Decisions is an established ISO 9001:2015 and ISO/IEC 27001:2013 certified small business and appraised at CMMI Level 3 for Services and Development. We possess a common vision of excellence and foster a collaborative team culture built upon individual performance and accountability. We invest in our people and systems to create value for our clients. It is the SkyePoint Way. We are grateful for the opportunity to work with exceptional people and give back to the communities we serve. Our employees value the flexibility at SkyePoint that allows them to balance quality work and their personal lives.

SkyePoint Decisions is a participating E-Verify Employer.

U.S. Citizenship is required for most positions.

Equal Opportunity Employer/Veterans/Disabled.

CCPA Disclosure Notice Here