RMF Security Engineer & Cyber Risk Lead

Amentum; Arlington (VA); On-site; USD 185,000 - 200,000; Full time

Job summary

Amentum seeks an Information Systems Security Officer (ISSO) and Cyber Security Subject Matter Expert to bridge high-level security policy with technical implementation. You will drive RMF and A&A lifecycle across multiple applications and environments, ensuring designs meet rigorous security objectives from concept to deployment.

Your work safeguards mission-critical systems by identifying, tracking, and mitigating vulnerabilities through continuous monitoring, STIG enforcement, and POA&M

Qualifications

• Experience implementing RMF and A&A across complex apps and environments.
• Familiarity with DISA STIGs and vulnerability management processes.
• Experience with cloud environments (AWS, Oracle Cloud) and related admin tools.
• Ability to document evidence artifacts (CONOPs, Control Implementation Plans, Test Plans).

Responsibilities

• Gather information for Body of Evidence within the authorization boundary.
• Ensure compliance with Cyber Security Controls and Overlays.
• Review vulnerability scans and create remediation plans.
• Document justifications when controls cannot be met due to functional constraints.
• Collaborate with GEODS teams and agency A&A personnel.
• Update CMDB and Service+ tickets as needed.

Skills

RMF process

NIST SP 800-53 Rev 5

Vulnerability assessment

STIG enforcement

Disaster recovery planning

Communication with A&A personnel

Analytical thinking

Cross-team collaboration

Education

Bachelor's degree+10 years experience

Tools

XACTA 360

CAP Tool

Job description

Amentum seeks an Information Systems Security Officer (ISSO) and Cyber Security Subject Matter Expert to bridge high-level security policy with technical implementation. You will drive RMF and A&A lifecycle across multiple applications and environments, ensuring designs meet rigorous security objectives from concept to deployment.

Your work safeguards mission-critical systems by identifying, tracking, and mitigating vulnerabilities through continuous monitoring, STIG enforcement, and POA&M