Security Analyst – Risk Management Framework (RMF) / Assessment & Authorization

WINTrio, LLC; Northern (KY); Hybrid; USD 85,000 - 120,000; Full time

Benefits offered by this job

Health insurance

401(k) Retirement Plan

Paid time off

Annual bonus

Job summary

WINTrio, LLC is seeking a Security Analyst to support RMF/A&A and ATO processes for USDA information systems. The role involves hands-on development of RMF artifacts, CSAM usage, and collaboration with government security stakeholders.

The position is remote with hybrid work in Maryland, requiring U.S. Citizenship. Responsibilities include maintaining SSPs, CPs, CMPs, IRPs, PIAs, and devising risk-based controls while ensuring compliance across RMF packages.

Qualifications

• Experience developing RMF/A&A artifacts (SSP, CP, CMP, IRP, BIA, PIA, ISA).
• Experience using CSAM or a comparable RMF governance, risk, and compliance system.
• Must be a U.S. citizen and able to meet background investigation requirements.
• Strong technical writing, documentation, analytical and quality-assurance skills.

Responsibilities

• Collect, review, and update system information in RMF packages.
• Create and maintain CSAM system records and narratives.
• Develop and upload PTAs, PIAs, and risk assessments.
• Finalize SSPs, CPs, CMPs, IRPs, BIAs, and ISAs with stakeholders.
• Support RMF concurrence reviews and remediation of findings.

Skills

RMF

A&A

ATO

Technical writing

Analytical skills

Tools

CSAM

Job description

# Security Analyst – Risk Management Framework (RMF) / Assessment & AuthorizationRemote with Hybrid Work in Maryland · Full Time**Position Title:** Security Analyst – Risk Management Framework (RMF) / Assessment & Authorization**Location:** Remote with Hybrid Work in Maryland **Citizenship:** U.S. Citizenship required **Employment Type:** Full-Time**How to Apply****Email your resume:** [e-mail]**Position Overview**WINTrio is seeking an experienced Security Analyst with strong Risk Management Framework (RMF), Assessment & Authorization (A&A), and Authority to Operate (ATO) experience to support USDA information systems.The position requires hands-on experience developing and maintaining Federal RMF/A&A packages and working with NIST and agency security requirements. USDA RMF and USDA CSAM experience are highly desirable.**Key Responsibilities*** Collect, review, and update system information.* Create and maintain system records in Cybersecurity Assessment and Management System (CSAM).* Develop/update and upload Privacy Threshold Analyses (PTAs).* Perform and document system security categorization.* Develop/update Privacy Impact Assessments (PIAs).* Develop/update E-Authentication Risk Assessments.* Maintain system identification information and system/technical narratives within CSAM.* Identify common and inherited security controls.* Develop and maintain compliance descriptions for security controls.* Support security-control tailoring.* Develop compensating controls where required.* Develop/update: + Contingency Plans (CP) + CP test, training, and exercise documentation + System of Records Notices (SORN) + Configuration Management Plans (CMP) + Incident Response Plans (IRP) + Business Impact Assessments (BIA) + Interconnection Security Agreements (ISA)* Finalize System Security Plan (SSP) compliance descriptions.* Finalize Contingency Plans.* Finalize CMPs, IRPs, and Disaster Recovery Plans where applicable.* Review RMF packages for completeness and readiness.* Assist USDA REE stakeholders in resolving findings and updating documentation during concurrence review.**Required Qualifications*** Working knowledge of: + NIST Risk Management Framework + FIPS PUB 199 + NIST SP 800-53 Rev. 4/5 + NIST SP 800-37 Rev. 2 + NIST SP 800-171 Rev. 2 + NIST SP 800-47 Rev. 1* Experience developing security-control implementation/compliance descriptions.* Experience developing Federal security and authorization documentation such as SSPs, CPs, CMPs, IRPs, BIAs, PIAs, ISAs, and related RMF artifacts.* Experience using CSAM or a comparable Federal governance, risk, and compliance/RMF system.* Experience completing all aspects of the NIST RMF process.* Ability to work collaboratively with system owners, ISSOs/ISSMs, technical teams, privacy personnel, and Government security stakeholders.* Strong technical writing, documentation, analytical, and quality-assurance skills.* Must be able to satisfy applicable background investigation/Public Trust, HSPD-12, PIV, and facility/system access requirements.**Highly Desired Qualifications*** Previous experience supporting USDA RMF programs.* Working knowledge of: + USDA Risk Management Framework 2.0 + USDA Six-Step RMF Process + USDA Departmental Regulation 3540-003, Security Assessment and Authorization + USDA POA&M procedures* Hands-on experience with the USDA CSAM instance.* Previous USDA or other Federal civilian agency cybersecurity experience.* Experience obtaining ATOs for FedRAMP products, platforms, or solutions.* Experience supporting FISMA-regulated Federal systems.* Prior participation in similar Federal RMF/A&A projects.**Work Environment*** Full-time position.* Primarily remote within the United States.* Occasional on-site support may be requested in the Washington, DC / Northern Virginia area.* Standard Federal business hours.* All work must be performed within the United States.**WINTrio Benefits*** Healthcare, Medical, Dental, and Vision* FSA and HSA options* 401(k) Retirement Plan* Annual Bonus and Profit Sharing Opportunities* Paid Time Off* Employee Assistance Program* Life and Disability Insurance**Equal Opportunity Employer**WINTrio LLC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to any characteristic protected by applicable law.Apply Now