RMF Engineer: DoD Authorization & Continuous Monitoring

Leidos Inc

Alexandria (VA)

On-site

USD 87,000 - 157,000

Full time

9 days ago

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Leidos is seeking experienced Risk Management Framework (RMF) Engineers to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. The RMF Engineer will support the development, maintenance, assessment, and authorization of cybersecurity packages for DHRA information systems.

This position will work directly with system owners, cybersecurity personnel, and Government stakeholders to ensure authorization packages are complete, technically accurate, current, and positioned to move

Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and 3 or more years of relevant professional experience.
Experience supporting the Department of Defense Risk Management Framework or comparable Federal system authorization processes.
Experience developing, reviewing, or maintaining cybersecurity authorization packages.
Experience working with System Security Plans, security controls, assessment artifacts, Plans of Action and Milestones, or continuous-monitoring documentation.
Experience assessing security-control implementation and supporting technical evidence.
Experience identifying authorization-package deficiencies and coordinating corrective actions with system owners and technical teams.
Experience supporting cybersecurity risk assessment, security testing, vulnerability analysis, system hardening, or compliance activities.

Responsibilities

Develop, review, and maintain complete RMF authorization packages.
Review and support development of System Security Plans (SSPs), system categorization, security-control selection, control implementation documentation, assessment results, authorization packages, and continuous-monitoring reports.
Maintain RMF authorization schedules, trackers, repositories, workflows, accounts, tickets, and status information.
Maintain and update authorization packages within the Enterprise Mission Assurance Support Service (eMASS).
Coordinate with system owners, cybersecurity personnel, technical teams, and Government stakeholders to obtain required authorization artifacts and supporting evidence.
Identify missing artifacts, incomplete documentation, control-implementation gaps, and other issues that may delay authorization.
Provide RMF and eMASS guidance to system owners and other program stakeholders.
Support Information System Security Manager and Information System Security Officer functions associated with system authorization and continuous monitoring.
Review security-control implementation and supporting evidence for completeness, technical accuracy, and compliance with applicable requirements.
Support cybersecurity compliance reviews and authorization-status reporting.
Develop, review, and track Plan of Action and Milestones (POA&M) items through remediation and closure.
Track conditions associated with an Authorization to Operate (ATO) and coordinate required corrective actions.
Perform quality assurance reviews of RMF submissions before Government review or assessment.
Support security-assessment planning, execution, documentation, and reporting.
Support continuous authorization and continuous-monitoring activities for authorized systems.
Assess the impact of changes in Department of Defense cybersecurity policy or authorization requirements and assist system owners in transitioning to new requirements.
Perform cybersecurity risk assessments and support security testing associated with system authorization.
Evaluate system hardening, vulnerabilities, configuration issues, and other technical security conditions that affect authorization risk.
Support vulnerability and compliance remediation activities associated with RMF findings and Plan of Action and Milestones items.
Troubleshoot cybersecurity compliance and authorization issues requiring coordination across system owners, engineers, administrators, cybersecurity teams, and Government stakeholders. Provide clear status, risk, and technical information to Government leadership regarding authorization progress, deficiencies, and actions required for resolution.