RMF Cybersecurity Analyst - ATO & Compliance Lead

Phase2 Technology; Washington (District of Columbia); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a RMF Cybersecurity Analyst to lead RMF/ATO activities, manage A&A tasks, and ensure compliance with NIST and DoD standards in Washington, DC. The role requires TS/SCI clearance and hands-on experience delivering RMF documentation and control packages.

The ideal candidate will translate technical risks into actionable reports for decision-makers and coordinate with ISSO counterparts across the lifecycle of systems.

Qualifications

• 3+ years of RMF A&A experience.
• Experience executing manual and automated A&A processes and artifact generation when tools unavailable.
• Experience developing RMF BOE documentation such as SSPs and RMF Control Family Plans.
• Knowledge of RMF ATO packages in eMASS.
• TS/SCI clearance.
• HS diploma or GED.

Responsibilities

• Lead RMF and ATO processes for multiple systems across their lifecycles.
• Manage cybersecurity assessments, A&A activities, and security policy implementation.
• Enforce CNSSI-1253, NIST 800-37, and NIST 800-53 standards.
• Validate security control implementations, perform verification and testing, and craft remediation strategies.
• Assess ACAS scans, STIGs, and controls to identify vulnerabilities and engineer mitigations.
• Translate complex risks into clear cybersecurity status reports for stakeholders and Authorizing Officials.

Skills

RMF A&A processes

SSP development

RMF control family plans

DoD/NIST standards knowledge

TS/SCI clearance

Education

HS diploma or GED

Tools

eMASS

ACAS

HBSS

STIGs

SCAP

VRAM

Job description

Booz Allen Hamilton is seeking a RMF Cybersecurity Analyst to lead RMF/ATO activities, manage A&A tasks, and ensure compliance with NIST and DoD standards in Washington, DC. The role requires TS/SCI clearance and hands-on experience delivering RMF documentation and control packages.

The ideal candidate will translate technical risks into actionable reports for decision-makers and coordinate with ISSO counterparts across the lifecycle of systems.