Security Compliance SME: FedRAMP/FISMA A&A Lead

Creative G C; Herndon (VA); Hybrid; USD 90,000 - 130,000; Full time

Job summary

Creative G C seeks a Security Compliance SME to obtain ATO/ATO in a DISA IL5 enclave. You will manage eMASS, coordinate 3PAOs, and drive SSP/POA&M artifacts. Remote-friendly with VA on-site requirements, you will guide vulnerability scans and risk-based decisions for federal security programs.

Required 5+ years leading FedRAMP/FISMA activities, strong technical writing, and ability to coordinate with assessors to sustain authorization lifecycle.

Qualifications

• 5+ yrs leading A&A for a FedRAMP or FISMA Moderate system through authorization and continuous monitoring
• Direct 3PAO coordination for significant FedRAMP changes (SAP scoping, evidence packages, test support, SAR adjudication)
• Authorship of SSP control statements against NIST SP 800-53 Rev 5 Moderate baseline
• Security impact analysis, risk-based AO recommendations, change type determinations
• POA&M management, deviation requests, and monthly ConMon reporting
• UiPath familiarity to describe bot behavior, credentials, and data flows in control terms
• Strong technical writing for AO and assessor communications

Responsibilities

• Attain an Authority to Connect and an Authority to Operate in a DISA IL5 enclave
• Maintain and update the eMASS profile and run daily vulnerability scans
• Develop and draft System Security Plan, System Assessment Plan, and related artifacts
• Prepare Plan of Action & Milestones, Contingency and Incident Response plans
• Oversee Configuration Management and System and Communications Protection artifacts

Skills

FedRAMP A&A

NIST SP 800-53 Rev 5

AO risk analysis

eMASS management

ACAS vulnerability scans

3PAO coordination

Technical writing

UiPath basics

Tools

eMASS

ACAS

UiPath

Job description

Creative G C seeks a Security Compliance SME to obtain ATO/ATO in a DISA IL5 enclave. You will manage eMASS, coordinate 3PAOs, and drive SSP/POA&M artifacts. Remote-friendly with VA on-site requirements, you will guide vulnerability scans and risk-based decisions for federal security programs.

Required 5+ years leading FedRAMP/FISMA activities, strong technical writing, and ability to coordinate with assessors to sustain authorization lifecycle.