Senior Information Security Officer — RMF/A&A Expert

Booz Allen Hamilton; Bethesda (MD); On-site; USD 62,000 - 141,000; Full time

Benefits offered by this job

Health benefits

Life insurance

Disability insurance

Retirement benefits

Paid leave

Tuition assistance

Professional development

Work-life programs

Dependent care

Job summary

Booz Allen Hamilton is seeking an Information System Security Officer to translate evolving cyber risk into clear action by supporting RMF activities and driving A&A packages through the Authorization to Operate process. You will collaborate with engineering and mission teams to scope controls, assess risk, remediate gaps, and sustain continuous monitoring to keep systems secure and compliant.

The role requires 5+ years in cyber risk management, 3+ years supporting A&A for health/government

Qualifications

• 5+ years of cyber risk management experience.
• 3+ years supporting A&A at health or government entities.
• Experience applying RMF across categorization, control selection or implementation, assessment, authorization, and continuous monitoring.
• Experience supporting A&A efforts and coordinating ATO decisions with authorizing officials.
• Experience performing security control assessments, producing SAR/POA&Ms, and developing SSPs and control statements.

Responsibilities

• Support RMF activities and drive A&A packages through the Authorization to Operate process.
• Partner with engineering and mission teams to scope controls, assess risk, and remediate gaps.
• Sustain continuous monitoring to maintain security and compliance across systems.

Skills

Cyber risk management

A&A coordination

RMF process

NIST SP 800-53 Rev.5

Continuous monitoring

Security documentation

Education

Bachelor’s degree

Master’s degree

Job description

Booz Allen Hamilton is seeking an Information System Security Officer to translate evolving cyber risk into clear action by supporting RMF activities and driving A&A packages through the Authorization to Operate process. You will collaborate with engineering and mission teams to scope controls, assess risk, remediate gaps, and sustain continuous monitoring to keep systems secure and compliant.

The role requires 5+ years in cyber risk management, 3+ years supporting A&A for health/government