Senior Cybersecurity RMF Engineer

Cybersecurity Jobs; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

Creative Visions seeks a Senior Cybersecurity RMF Engineer to support a DoD RMF program at Aberdeen Proving Ground, MD. The role emphasizes hands-on RMF implementation, control assessments, and continuous monitoring to help establish and sustain ATOs in DoD environments.

The engineer will prepare and maintain RMF artifacts (SSPs, SARs, POA&Ms), coordinate with ISSOs/ISSMs and government stakeholders, and work across Windows, Linux, and Apple systems.

Qualifications

• 5+ years RMF lifecycle reporting experience.
• Experience supporting DoD RMF implementation.
• Familiarity with NIST SP 800-37/800-53.
• Active Secret clearance.
• Experience with Windows, Linux, and Apple operating systems.
• DoD cybersecurity workforce qualification requirements.

Responsibilities

• Execute DoD RMF lifecycle activities across authorization and continuous monitoring.
• Develop, review, and maintain RMF documentation (SSPs, SARs, POA&Ms).
• Support ATO development, maintenance, and reauthorization.
• Conduct risk assessments and security control evaluations; ensure compliance.
• Assess configurations against DISA STIGs and NIST controls.
• Document remediation of vulnerabilities and compliance deficiencies.
• Collaborate with ISSOs/ISSMs and government stakeholders.

Skills

RMF lifecycle

DoD cybersecurity

Documentation

Windows/Linux/Apple

Security clearance

Tools

eMASS

ACAS

SCAP

STIG Viewer

Job description

Creative Visions is seeking a Senior Cybersecurity RMF Engineer to support a prospective U.S. Army cybersecurity engineering and Risk Management Framework (RMF) program at Aberdeen Proving Ground, Maryland. The role focuses on hands‑on RMF implementation, security control assessment, continuous monitoring support, and authorization documentation to help establish and sustain Authorities to Operate (ATOs) in DoD environments.

Role Overview

Support DoD RMF lifecycle activities for information systems, including authorization documentation and ongoing compliance. The engineer will conduct risk assessments, evaluate security controls against applicable standards and guidance, and coordinate with cybersecurity and government stakeholders to address security requirements across system architectures.

Key Responsibilities

• Execute DoD RMF lifecycle activities, including security categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Develop, review, and maintain RMF authorization documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and related security artifacts.
• Support ATO development, maintenance, and reauthorization activities for DoD information systems.
• Conduct cybersecurity risk assessments, security control evaluations, and compliance reviews.
• Assess system configurations against DISA Security Technical Implementation Guides (STIGs), NIST security controls, and DoD cybersecurity requirements.
• Identify, document, track, and support remediation of cybersecurity vulnerabilities and compliance deficiencies.
• Perform continuous monitoring activities to maintain system security authorizations and compliance.
• Support hardware and software inventory reconciliation, configuration management, and security baseline reviews.
• Evaluate proposed hardware and software changes for potential cybersecurity risks and impacts to system authorization.
• Support security control assessments, verification and validation activities, and Security Control Assessor (SCA) reviews.
• Collaborate with cybersecurity architects, system administrators, network engineers, ISSO and ISSM teams, and government stakeholders to address security requirements.
• Support cybersecurity engineering activities involving Windows, Linux, and Apple operating systems.
• Prepare technical reports, assessment findings, remediation recommendations, and cybersecurity compliance documentation.
• Participate in technical reviews, configuration control activities, and cybersecurity planning meetings.

Required Qualifications

• Minimum 5 years of professional experience supporting RMF lifecycle reporting and cybersecurity authorization activities.
• Minimum 5 years of experience supporting hardware/software reconciliation, consistent with the PWS combined experience requirement.
• Demonstrated experience supporting DoD RMF implementation and compliance activities.
• Working knowledge of NIST SP 800-37, NIST SP 800-53, and applicable DoD cybersecurity policies.
• Experience developing and maintaining RMF authorization documentation, including SSPs, SARs, and POA&Ms.
• Experience supporting cybersecurity risk assessments, vulnerability management, and security control evaluations.
• Familiarity with DISA STIGs, security configuration baselines, and vulnerability remediation processes.
• Experience supporting configuration management and hardware/software inventory reconciliation.
• Experience working with Windows, Linux, and Apple operating systems.
• Experience supporting classified and unclassified information systems.
• Strong analytical, technical documentation, and communication skills.

Technologies

• NIST SP 800-37
• NIST SP 800-53
• DISA Security Technical Implementation Guides (STIGs)
• Windows, Linux, Apple operating systems

Required Certification

• CompTIA CASP+ / SecurityX or equivalent cybersecurity certification, consistent with DoD cybersecurity workforce qualification requirements.

Security Clearance

• Active Secret security clearance required at the time of application.
• Must be able to maintain the required clearance and eligibility for access to DoD information systems, including SIPRNet environments, throughout contract performance.

Preferred Qualifications

• Previous experience supporting U.S. Army or other DoD cybersecurity programs.
• Experience using eMASS for RMF authorization documentation and workflow management.
• Familiarity with ACAS, SCAP, STIG Viewer, and other DoD cybersecurity assessment tools.
• Experience supporting SIPRNet or other classified network environments.
• Experience performing security assessments across enterprise networks, servers, and cloud environments.
• Familiarity with DoD Instruction 8510.01, DoD Instruction 8500.01, and Army cybersecurity regulations.
• Experience supporting Security Control Assessors (SCAs), ISSOs, or ISSMs.
• Additional cybersecurity certifications such as CISSP, CISM, or Security+.

Work Environment and Location

• Onsite support at Aberdeen Proving Ground, Maryland as part of cybersecurity operations.
• Candidates must be willing and able to work onsite as required by the Government.
• Remote or hybrid arrangements may be considered only if authorized under the resulting contract.
• The position may involve working with classified information systems and participating in cybersecurity activities requiring adherence to applicable DoD security procedures.