RMF Security Automation Engineer

Steampunk; McLean (VA); On-site; USD 130,000 - 180,000; Full time

Job summary

Steampunk is seeking an RMF Security SME to modernize our security posture by automating control implementation and continuous monitoring in cloud environments. This role blends deep RMF knowledge with hands-on DevSecOps engineering to build secure, auditable systems.

You will interpret NIST SP 800-53 controls, map requirements to automated pipelines, and collaborate across engineering, data science, and design teams to balance security with usability and speed in delivery.

Qualifications

• Ability to obtain a U.S. government Security Clearance.
• Experience architecting, designing, developing, and implementing cloud solutions.
• Experience with one or more cloud platforms (AWS, Azure, or GCP).
• 5 years of experience conducting monitoring, risk assessment, threat modeling, and security testing in cloud environments.
• 5 years of experience applying the RMF, including documenting POA&Ms, SSPs, and A&A support documentation.
• Active, relevant cloud/security certifications (e.g., CISSP, AWS/SOC, CAP) as approved.

Responsibilities

• Serve as RMF SME, interpreting NIST SP 800-53 controls and mapping to automated implementations.
• Design and implement control automation pipelines using IaC and OSCAL.
• Identify and drive implementation of controls in secure cloud solutions and zero-trust components.
• Collaborate with stakeholders to balance security requirements with usability.
• Review infrastructure as code for control coverage, risk, and compliance impact.
• Conduct risk and control assessments to meet RMF/NIST baselines.
• Automate vulnerability management, patching, and control monitoring/reporting.
• Embed RMF requirements into SDLC/CI/CD pipelines with developers and DevSecOps engineers.
• Support data protection and encryption controls for data at rest/in transit.
• Produce SSPs, POA&Ms, and control assessment artifacts.

Skills

RMF expertise

Cloud security

DevSecOps

Threat modeling

Automated control implementation

Continuous monitoring

Education

No degree 9 years

Bachelor's degree

Master's degree

Tools

AWS

Azure

GCP

OSCAL

XACTA

eMASS

Job description

Steampunk is seeking an RMF Security SME to modernize our security posture by automating control implementation and continuous monitoring in cloud environments. This role blends deep RMF knowledge with hands-on DevSecOps engineering to build secure, auditable systems.

You will interpret NIST SP 800-53 controls, map requirements to automated pipelines, and collaborate across engineering, data science, and design teams to balance security with usability and speed in delivery.