RMF Security Engineer — Azure Government ATO Lead

Page Mechanical Group, Inc.; Fort Meade (MD); On-site; USD 145,000 - 155,000; Full time

Benefits offered by this job

Medical, Dental & Vision

Mental Health Resources

Paid Time Off & Holidays

401(k) with Company Matching

Life, Accident & Injury Insurance

FSA

HSA

Certification Preparation & Exam Reimb

Job summary

Total Force Alliance, LLC is seeking a Security Engineer/ISSE to own RMF execution for DoD/federal systems deployed in Azure Government. You will author SSP/POA&M, manage eMASS packages, and coordinate with Government ISSMs to sustain ATOs while ensuring a robust continuous-monitoring program.

The role requires 7+ years in security engineering for federal systems, hands‑on RMF, and a DoD 8140/8570‑compliant certification, plus an active TS/SCI clearance.

Qualifications

• 7+ years in information system security engineering/cybersecurity for federal or DoD systems, with direct, hands‑on RMF experience.
• Demonstrated ownership of at least two systems through a full RMF authorization to an ATO/cATO — SSP, control implementation, POA&M, and package management.
• Hands‑on experience with eMASS (or equivalent) and NIST 800-53 control implementation and assessment.
• Experience hardening systems to DISA STIGs and validating compliance.
• Working knowledge of cloud security architecture — identity, network isolation (private endpoints), key management, and SIEM/continuous monitoring.
• Understanding of CUI handling (DoDI 5200.48) and the DoD Cloud Computing SRG impact levels.
• DoD 8140/8570‑compliant certification for the ISSE role (e.g., CISSP, CASP+, or equivalent).
• Strong technical writing and the ability to produce assessor‑ready evidence.
• Ability to carry security engineering and authorization across multiple environments on a lean, senior team.
• Candidates must have and maintain an active TS/SCI clearance with the Department of Defense.

Responsibilities

• Own RMF execution across NIST 800-37 / 800-53 and DoDI 8510.01.
• Author and maintain the System Security Plan (SSP), POA&M, and full control‑implementation evidence; manage the authorization package in eMASS (or the Government's system of record).
• Serve as the security engineering interface to the Government ISSM/AO and assessors; prepare for and support all assessment‑and‑authorization activities.
• Implement and validate hardening against applicable DISA STIGs (application/ASD, container, database, OS) and track remediation to closure.
• Design and operate the continuous‑monitoring posture — audit logging, SIEM integration (Microsoft Sentinel / Log Analytics), and control‑assessment cadence — and maintain POA&M currency.
• Engineer and verify the data‑protection posture: encryption in transit and at rest, key management (Key Vault / managed identity, customer‑managed keys, FIPS‑validated cryptography), and no secrets in source or image.
• Own the CAC/PIV / DoD PKI validation design (OCSP/CRL) with the cloud and application engineers.
• Enforce CUI handling and, where applicable, cross‑domain and classified‑data controls and spillage prevention.
• Implement least‑privilege access, zero‑trust controls, and privileged‑access administration (Bastion / JIT / MFA / privileged access workstations).
• Produce and maintain the security documentation and as‑built records required for accreditation and customer handoff.

Skills

RMF experience

NIST 800-53

DISA STIGs

Cloud security

CUI handling

DoD 8140/8570

TS/SCI clearance

Technical writing

Cross-environment security

Security engineering

Tools

eMASS

Job description

Total Force Alliance, LLC is seeking a Security Engineer/ISSE to own RMF execution for DoD/federal systems deployed in Azure Government. You will author SSP/POA&M, manage eMASS packages, and coordinate with Government ISSMs to sustain ATOs while ensuring a robust continuous-monitoring program.

The role requires 7+ years in security engineering for federal systems, hands‑on RMF, and a DoD 8140/8570‑compliant certification, plus an active TS/SCI clearance.