RMF/ISSO Analyst

DecisionPoint | Cortek; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

DecisionPoint | Cortek is seeking a Senior RMF/ISSO Analyst to support Risk Management Framework, authorization, control assessment, and continuous-monitoring for USMEPCOM ENLIST. You will maintain artifacts, evidence, interconnection agreements, and provide thorough review of packages with government stakeholders.

The role requires active clearance, a security-focused background, and DoD RMF experience, with remote work and a preference for candidates in the Chicago area.

Qualifications

• Active Secret clearance or higher.
• Bachelor's degree in Cybersecurity, Information Systems, or a related field.
• Minimum of 10 years of relevant cybersecurity, information assurance, RMF, or information-system security experience.
• Current CompTIA Security+ certification.
• Experience supporting the Department of Defense Risk Management Framework.
• Proficiency with eMASS or the Government-designated authorization repository.

Responsibilities

• Maintain Risk Management Framework authorization packages and supporting documentation throughout the system authorization lifecycle.
• Develop and maintain security-control implementation statements, control evidence, system security documentation, and continuous-monitoring records.
• Maintain system-level Plans of Action and Milestones, including findings, remediation actions, milestones, responsible parties, supporting evidence, and closure status.
• Develop, review, and maintain system interconnection agreements and related authorization documentation.
• Support compliance with the USMEPCOM Tenant Security Plan for the organization’s portion of the DoD Information Network Non-classified Internet Protocol Router Network.
• Support Authority to Operate and Authority to Connect package development, review, submission, maintenance, and renewal activities.
• Review authorization packages for accuracy, completeness, consistency, and traceability before Government or assessor submission.
• Evaluate security-control implementation and evidence against applicable NIST SP 800-53, DoD, Army, and USMEPCOM requirements.
• Support security-control testing for USMEPCOM systems, applications, networks, and supporting infrastructure.
• Conduct internal authorization-readiness reviews and execute required checks and tests in accordance with the DoD Risk Management Framework.
• Develop Security Test and Evaluation test plans addressing applicable NIST, DoD, Army, and USMEPCOM information-system security testing requirements.
• Support the preparation of at least two Security Test and Evaluation test plans and the resulting testing activities during the task‑order period.
• Collect, organize, validate, and upload authorization evidence in eMASS or the Government-designated repository.
• Maintain traceability among security controls, implementation statements, test results, vulnerabilities, remediation activities, and authorization decisions.
• Analyze assessor comments and coordinate responses with system owners, engineers, administrators, developers, and Government cybersecurity personnel.
• Resolve documentation deficiencies and ensure assessor comments are addressed with accurate explanations and appropriate supporting evidence.
• Monitor authorization conditions, open findings, expiring artifacts, and continuous-monitoring requirements.
• Support security-status reporting, risk summaries, authorization schedules, and cybersecurity briefings for Government and program leadership.
• Identify authorization risks, evidence gaps, and potential schedule impacts and recommend practical corrective actions.
• Protect sensitive cybersecurity documentation and ensure records are handled in accordance with applicable Government requirements.

Skills

RMF

Cybersecurity

Documentation

Education

Bachelor's degree in Cybersecurity, Information Systems, or a related field

CompTIA Security+ certification

Tools

eMASS

Job description

Overview

DecisionPoint seeks a Senior RMF/ISSO Analyst to support Risk Management Framework, authorization, security-control assessment, and continuous-monitoring activities for the USMEPCOM ENLIST program.

The RMF/ISSO Analyst will maintain authorization artifacts, control implementation statements, interconnection agreements, continuous-monitoring evidence, and system-level Plans of Action and Milestones. This role will support Tenant Security Plan compliance, Authority to Operate and Authority to Connect package reviews, security-control testing, and Security Test and Evaluation planning and execution.

The successful candidate will work with the Government Information System Security Manager, system owners, technical teams, assessors, and other cybersecurity stakeholders to resolve review comments and maintain complete, accurate, and traceable authorization evidence.

This position is remote, with a preference for candidates located in the Chicago area.

Duties & Responsibilities

The RMF/ISSO Analyst will:

• Maintain Risk Management Framework authorization packages and supporting documentation throughout the system authorization lifecycle.
• Develop and maintain security-control implementation statements, control evidence, system security documentation, and continuous-monitoring records.
• Maintain system-level Plans of Action and Milestones, including findings, remediation actions, milestones, responsible parties, supporting evidence, and closure status.
• Develop, review, and maintain system interconnection agreements and related authorization documentation.
• Support compliance with the USMEPCOM Tenant Security Plan for the organization's portion of the DoD Information Network Non-classified Internet Protocol Router Network.
• Support Authority to Operate and Authority to Connect package development, review, submission, maintenance, and renewal activities.
• Review authorization packages for accuracy, completeness, consistency, and traceability before Government or assessor submission.
• Evaluate security-control implementation and evidence against applicable NIST SP 800-53, DoD, Army, and USMEPCOM requirements.
• Support security-control testing for USMEPCOM systems, applications, networks, and supporting infrastructure.
• Conduct internal authorization-readiness reviews and execute required checks and tests in accordance with the DoD Risk Management Framework.
• Develop Security Test and Evaluation test plans addressing applicable NIST, DoD, Army, and USMEPCOM information-system security testing requirements.
• Support the preparation of at least two Security Test and Evaluation test plans and the resulting testing activities during the task‑order period.
• Collect, organize, validate, and upload authorization evidence in eMASS or the Government-designated repository.
• Maintain traceability among security controls, implementation statements, test results, vulnerabilities, remediation activities, and authorization decisions.
• Analyze assessor comments and coordinate responses with system owners, engineers, administrators, developers, and Government cybersecurity personnel.
• Resolve documentation deficiencies and ensure assessor comments are addressed with accurate explanations and appropriate supporting evidence.
• Monitor authorization conditions, open findings, expiring artifacts, and continuous-monitoring requirements.
• Support security-status reporting, risk summaries, authorization schedules, and cybersecurity briefings for Government and program leadership.
• Identify authorization risks, evidence gaps, and potential schedule impacts and recommend practical corrective actions.
• Protect sensitive cybersecurity documentation and ensure records are handled in accordance with applicable Government requirements.

Qualifications

Required Qualifications

• Active Secret clearance or higher.
• Bachelor's degree in Cybersecurity, Information Systems, or a related field.
• Minimum of 10 years of relevant cybersecurity, information assurance, RMF, or information-system security experience.
• Current CompTIA Security+ certification.
• Experience supporting the Department of Defense Risk Management Framework.
• Proficiency with eMASS or the Government-designated authorization repository.

Preferred Qualifications

• Experience performing Information System Security Officer duties in a federal or DoD environment.
• Experience supporting Government ISSMs, system owners, Security Control Assessors, Authorizing Officials, or Common Control Providers.
• Working knowledge of DoDI 8510.01, NIST SP 800-37, NIST SP 800-53, FISMA, and applicable DoD cybersecurity policies.
• Experience developing or maintaining system security plans, control implementation statements, interconnection agreements, continuous-monitoring strategies, and authorization decision documentation.
• Experience supporting AT