RMF Security Automation Architect

UNAVAILABLE; McLean (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

UNAVAILABLE is seeking an RMF Security SME to modernize security posture by moving from manual compliance to automated control implementation with continuous monitoring. The role blends RMF/NIST expertise with hands-on cloud and DevSecOps engineering, partnering with engineers, data scientists, designers, and analysts to build secure, auditable systems.

The candidate will design automation pipelines, map controls to automated workflows, and embed RMF into the SDLC and CI/CD processes, ensuring

Qualifications

• Experience translating RMF/NIST controls into automated, auditable implementations.
• Experience with cloud/DevSecOps and security automation.
• Active security certification (CISSP or cloud security) preferred.

Responsibilities

• Serve as RMF SME, mapping controls to automated implementations and continuous monitoring.
• Design control automation pipelines using IaC and compliance-as-code approaches.
• Identify and drive secure cloud controls, incl. IAM, zero-trust, and data privacy controls.
• Collaborate with stakeholders to balance security with usability and translate RMF into technical solutions.
• Review infrastructure as code for control coverage, risk, and compliance impact.
• Conduct risk and control assessments to meet NIST/FISMA and other frameworks.
• Automate vulnerability management, patch management, and control monitoring/reporting.
• Embed RMF requirements into SDLC and CI/CD pipelines with software developers.
• Support data protection and encryption across data at rest and in transit.
• Document current controls and gap analyses; produce remediation options and recommendations.
• Drive automation for RMF processes and A&A artifacts (SSPs, POA&Ms).
• Identify, analyze, and resolve infrastructure vulnerabilities affecting compliance.
• Propose continuous improvements to control automation and security operations.
• Present status updates and cross-train team members on RMF processes.

Skills

Security clearance

Cloud/DevSecOps

RMF/NIST expertise

Threat modeling

Automation / IaC

Education

No degree with 9 years of relevant experience

Bachelor's degree w/ 5 years relevant experience

Master's degree w/ 3 years relevant experience

Tools

OSCAL

eMASS

Xacta

CSAM

AWS

Azure

GCP

Job description

UNAVAILABLE is seeking an RMF Security SME to modernize security posture by moving from manual compliance to automated control implementation with continuous monitoring. The role blends RMF/NIST expertise with hands-on cloud and DevSecOps engineering, partnering with engineers, data scientists, designers, and analysts to build secure, auditable systems.

The candidate will design automation pipelines, map controls to automated workflows, and embed RMF into the SDLC and CI/CD processes, ensuring