RMF & ISSM Support Specialist - JOMIS

Sentar; Charleston (SC); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Voluntary Medical, Dental, Vision

401(k) match

Generous PTO

Other leave programs; holiday schedule

Job summary

Sentar in Charleston, SC is seeking a RMF & ISSM Support Specialist to support DHA efforts by managing RMF packages, continuous monitoring, and security controls across DoD medical devices and systems.

The role emphasizes collaboration with ISSMs, system admins, and government stakeholders, delivering WSRs and ensuring compliance with NIST 800-53, STIGs, and related DoD requirements. On-site work with an employee-owned culture awaits.

Qualifications

• 6–8+ years hands-on cybersecurity engineering in DoD or Federal environments with RMF depth.
• Hands-on eMASS experience; develop and manage SSPs, ATOs, POA&Ms and security artifacts.

Responsibilities

• Lead RMF/ISSM activities to complete security packages and sustain Authorization.
• Coordinate with ISSMs, admins, engineers, and government stakeholders for control implementation.
• Submit WSRs and lead RMF/security engineering status meetings.

Skills

Cybersecurity engineering

Clear written and verbal communication

Zero Trust / IAM concepts

DoD / Federal security framework

Education

Bachelor's Degree in Cybersecurity or related field

10+ years equivalent experience

Tools

Terraform

Ansible

AWS Config Rules

Azure Policy

Kubernetes/OpenShift security

ACAS/Nessus / SCAP / STIG

eMASS / CMRS / COAMS

HBSS / ESS analysis

Job description

Sentar is proud to be an employee-owned company, fostering a culture of empowerment, collaboration, and innovation. Sentar is dedicated to developing the critical talent that the connected world demands to create solutions to address the convergence of cybersecurity, intelligence, analytics, and systems engineering. We invite you to join the team where you can build, innovate, and secure your career.

Sentar is seeking a RMF & ISSM Support Specialist in Charleston, SC!

Role Description

The Defense Health Agency (DHA) supports the delivery of integrated, affordable, and high-quality health services to Military Health System (MHS) beneficiaries and is responsible for driving greater integration of clinical and business processes across the MHS. Our DHA teams make a difference daily by ensuring the security of the health records of active duty and retired military and their families!

The Defense Health Cyber Risk Management Team requires a RMF & ISSM Support Specialist to provide key services to a government client. This individual will be responsible for assigned Information Systems Security Manager (ISSM) efforts to complete RMF packages (Security Plans, Annual Security Reviews, Authorizations, POA&Ms, etc.), conduct continuous monitoring of assigned systems, and provide relevant cyber security expertise to ongoing programmatic lines of effort.

This position for JOMIS Cyber Support, Risk Management Executive Division (RMED) supported by the Defense Health Agency (DHA). The RMF & ISSM Support SME navigates and coordinates workflow, activity, and documentation necessary to achieve successful RMF objectives for DHA medical devices and systems.

Duties

Cloud & Application Security Engineering

• Architect and implement secure, zero trust, defense-in-depth solutions across infrastructure, platform, and application layers for cloud-hosted and DDIL environments;
• Develop and enforce cloud security baselines and automated policy guardrails using IaC tools (Terraform, Ansible, AWS Config Rules, Azure Policy);
• Engineer IAM solutions including RBAC, ABAC, MFA, least-privilege, and PAM across cloud and application environments;
• Secure containerized workloads (Kubernetes/OpenShift) including pod security policies, network policies, secrets management, and runtime threat detection (Falco, Prisma Cloud/Twistlock);
• Embed security into CI/CD pipelines per the DoD DevSecOps Reference Design, automating SAST, DAST, SCA, container image scanning, and STIG compliance validation;
• Integrate application security across the SDLC including secure code review, SAST, DAST, SCA, and API security testing;
• Design and implement cloud-native SIEM/monitoring capabilities (AWS Security Hub, CloudTrail, Azure Sentinel) supporting continuous monitoring and RMF compliance;
• Implement data protection strategies including encryption at rest/in transit and cryptographic key management (AWS KMS, Azure Key Vault);
• Lead threat modeling and security architecture reviews for new and evolving JOMIS capabilities;
• Evaluate and harden DDIL/edge security configurations for disconnected and bandwidth-constrained operational environments;

RMF & Compliance

• Execute end-to-end RMF authorization activities including SSP development, SCAs, POA&M management, and ATO package maintenance in eMASS, CMRS, COAMS, and Phoenix;
• Apply NIST SP 800-53 controls, DISA STIGs/SRGs, and DoD/DHA IA requirements to assess, document, and remediate system security posture;
• Conduct vulnerability analysis using ACAS/Nessus, STIG Viewer, and SCAP; analyze HBSS/ESS output and configurations; perform root cause analysis on cybersecurity shortfalls;
• Review and validate authorization boundary diagrams, architecture/data flow diagrams, hardware/software inventories, IP/subnet assignments, and Med-COI Zone taxonomy artifacts;

Stakeholder Engagement & Reporting

• Serve as senior technical security advisor to program leadership, IPTs, and government stakeholders through engineering review boards and architecture working groups;
• Coordinate with ISSMs, system/network administrators, software engineers, and CIOs to validate and document control implementation;
• Submit Weekly Status Reports (WSRs) and lead/attend stakeholder meetings on RMF and security engineering status.

Qualifications

• 6–8+ years of hands‑on cybersecurity engineering experience in DoD or Federal environments, with demonstrated depth across RMF.
• RMF/Compliance: Hands‑on eMASS experience; proven ability to develop and manage ATO packages, SSPs, SCAs, and POA&Ms; proficiency with ACAS/Nessus, SCAP, STIG Viewer, HBSS/ESS analysis;

Preferred

• Cloud Security: 3+ years securing AWS GovCloud and/or Azure Government environments; experience with cloud‑native security tooling (Security Hub, CloudTrail, Azure Sentinel, Defender), secure landing zone design, and network micro‑segmentation;
• IaC & Automation: Proficiency with Terraform, Ansible, CloudFormation, or Helm for automated, policy‑compliant infrastructure deployment and security hardening;
• Application Security: Experience with SAST, DAST, SCA, and API security testing integrated into CI/CD pipelines (GitLab, Jenkins, or equivalent); familiarity with secure SDLC practices per DoD DevSecOps Reference Design;
• Containers & Microservices: Hands‑on Kubernetes/OpenShift security including pod security standards, image scanning, secrets management, and runtime detection tooling;
• IAM/Zero Trust: Demonstrated implementation of RBAC, ABAC, MFA, PAM, and zero trust access models in cloud and application environments;
• DDIL/Edge: Familiarity with DDIL architecture security challenges including offline operations, data synchronization, and edge hardening;
• Frameworks: Strong working knowledge of NIST SP 800-53, NIST SP 800-144, NIST SP 800-115, DISA STIGs/SRGs, DoD DevSecOps Reference Design, and DoD 8570/8140;
• Strong written and verbal communication skills; ability to translate complex technical findings for both technical and executive audiences.

Clearance Level

Education

Bachelor's Degree in Cybersecurity, Computer Science, Systems Engineering, or related STEM field; or at least 10 years of technical equivalent demonstrable experience.

Certifications

IAT Level II required (e.g., CompTIA Security+ CE); One or more of the following strongly desired: CISSP, CASP+, CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate; Additional certifications such as CSSLP, GWEB, GPEN, or CEH are a plus

Benefits at Sentar

Our unique employee ownership model attracts top talent, giving employees the freedom to take initiative and drive meaningful improvements. In addition to cultivating a thriving and inclusive work environment, Sentar offers an extensive benefits package designed to support the well‑being of employees and their families. Employee ownership is the foundation of our culture, promoting participation, teamwork, and accountability while ensuring long‑term financial security and a commitment to excellence.

• Voluntary Medical, Dental, Vision, with Flexible Spending Plan options
• Voluntary Life, Critical Illness, Accident, and Long Term Care insurance options
• Group Term Life, Short-Term and Long-Term Disability is provided by Sentar to all qualifying employees
• Generous 401(k) match
• Competitive PTO plan that graduates quickly with years of service
• Other leave programs; holiday schedule along with bereavement, maternity, jury and military duty

Sentar is an affirmative action and equal opportunity employer M/F/Vets/Persons with Disabilities

We want you to build your career at Sentar, so if you are an individual with a disability and require a reasonable workplace accommodation applying for a job or at any point in the employment process, contact the Recruiting Manager at [e-mail] . Please indicate the specifics of the assistance needed. Thank you for considering Sentar in your employment search.

Build, Innovate, Secure Your Career at Sentar.