Senior DoD Risk Management Framework SME

RMC - Resource Management Concepts Inc.; Charleston (SC); Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Tuition assistance

Certification support

Paid federal holidays

Healthcare plans

401K

Job summary

Resource Management Concepts, Inc. (RMC) is seeking a Senior DoD RMF SME to support a federal agency mission in Charleston, SC. The role focuses on authoritative liaison for inheritable controls and ensuring author, validate, and publish of common controls in enterprise environments.

This senior role blends deep RMF expertise with high-level stakeholder communication, requiring TS/SCI with polygraph. The position offers a highly flexible hybrid schedule with partial on-site work at a secure

Qualifications

• Bachelor's degree or higher in Cybersecurity, Engineering, Mathematics with CS concentration, or equivalent.
• TS/SCI DoD clearance with ability to obtain CI polygraph.
• 5+ years implementing RMF with NIST SP 800-37 Rev. 2 and NIST SP 800-53.
• Proficiency documenting and managing risk packages in eMASS.
• DoD 8140/8570 IAM Level II or III certs (CISSP/CISM/CAP).
• Ability to commute to Charleston, SC or NCR.

Responsibilities

• Develop, maintain, and expand enterprise CCP authorization packages in eMASS.
• Map and guide inherited controls to tenant System Owners and ISSOs.
• Define security boundary limits between hosting and tenant environments.
• Coordinate assessments with independent SCAs for multi-tier audits.
• Create and manage POA&Ms targeting enterprise-wide vulnerabilities.
• Drive automated monitoring to progress to Continuous Authorization to Operate (cATO).

Skills

RMF/NIST 800-37

eMASS

risk packages

DoD security

SCA coordination

Education

Bachelor's degree in Cybersecurity/Engineering/Math

Master's degree preferred

Tools

eMASS

AWS GovCloud

Azure Government

Job description

Position Title: Senior DoD Risk Management Framework SME

Location: Charleston, South Carolina,

Department: Information Technology

Work Type: Full time

Workplace Type: Hybrid

Description

Resource Management Concepts, Inc. (RMC) provides high-quality, professional services to government and commercial sectors. Our mission is to deliver exceptional management and technology solutions supporting the protection and preservation of the people and environment of the United States of America.

RMC is seeking a Senior DoD RMF Common Control Provider (CCP) Specialist to directly support an essential federal agency mission. In this role, you will operate as the primary authoritative liaison for inheritable enterprise security controls. You will ensure that foundational computing environments, cloud environments, and enterprise enclaves correctly author, validate, and publish the common controls inherited by downstream tenant mission systems.

This is a high-visibility contractor role requiring an expert split between deep technical framework familiarity and strategic stakeholder communication. This position is contingent on contract award and position availability. The position allows for a highly flexible hybrid work schedule, requiring part-time on-site presence at our secure facility in Charleston, SC, with remaining days eligible for telework.

Core Responsibilities:

• Enterprise Control Authoring: Develop, maintain, and expand the agency's enterprise-level Common Control Provider (CCP) authorization packages within eMASS.
• Inheritance & Downstream Liaison: Provide direct technical guidance to tenant System Owners (SOs) and Information System Security Officers (ISSOs) to map out how they safely inherit physical, operational, and technical controls.
• Boundary Validation: Audit and define where the physical and logical security boundaries of the hosting infrastructure end and where the tenant's responsibility begins.
• Assessment Coordination: Partner with independent Security Control Assessors (SCAs) to schedule, facilitate, and clear multi-tiered technical audits of shared platforms.
• POA&M and Vulnerability Management: Create, execute, and monitor complex Plans of Action and Milestones (POA&M) specifically targeting enterprise-wide vulnerabilities affecting multiple systems.
• Continuous Authorization: Drive the integration of automated monitoring capabilities to progress infrastructure from traditional static windows to a Continuous Authorization to Operate (cATO) state.

Requirements

• Bachelor's degree in Cybersecurity, Computer/Electrical/Electronics Engineering, or Mathematics with a computer science concentration, or equivalent.
• TS/SCI DoD clearance with the ability to obtain a CI polygraph.
• 5+ years implementing NIST SP 800-37 Rev. 2 (RMF) and NIST SP 800-53 controls in federal or DoD environments.
• Proficiency documenting and managing risk packages in eMASS.
• Meet DoD 8140/8570 IAM Level II or III certification requirements (e.g., CISSP, CISM, CAP/ISC2 CGRC).
• Ability to commute to project sites in Charleston, SC, or the National Capital Region.

Desired Skills

• Master's degree in a field listed above or equivalent.
• Intelligence Community experience.
• Experience managing security control allocation for AWS GovCloud, Azure Government, or federal multi-tenant data centers.
• Strong advisory skills, including explaining complex risk methodologies to GS-15 and SES stakeholders.
• Familiarity with CSSP alignment and Cloud Landing Zone security.

Benefits

At RMC, we're committed to your career growth! RMC differentiates itself from other firms through its investment in our employees. We invest our resources to train, certify, educate, and build our employees.

RMC can offer you a great place to work with a small company feel and give you the experience, tuition assistance, and certifications that will take your career to the next level. This also includes a competitive paid vacation package with 11 paid federal holidays. Additionally, we also offer high-quality, low-deductible healthcare plans, pet insurance, and a competitive 401K package.

Salary at RMC is determined by various factors, including but not limited to location, a candidate's specific combination of education, knowledge, skills, competencies, and experience, as well as contract-specific requirements.