Senior RMF Cybersecurity Engineer (Secret) - Aberdeen Test Center

CyberMyte, LLC; Aberdeen (MD); On-site; USD 120,000 - 140,000; Full time

Benefits offered by this job

Certifications paid including renewals

$5,000 annual training stipend

Onsite work at Aberdeen

Job summary

CyberMyte, LLC is seeking a Senior RMF Cybersecurity Engineer (Secret) for the U.S. Army Aberdeen Test Center, Aberdeen Proving Ground, Maryland. This fully onsite role focuses on RMF package work, controls implementation, and continuous monitoring across classified networks.

You will reconcile inventories and baselines, support assessments, and coordinate with Government cybersecurity staff. A Secret clearance and CASP+/8570 baseline certification are required by bid submission; remote work is

Qualifications

• United States citizen with active Secret clearance for bid submission.
• CASP+ or DoD 8570/8140 baseline certification required at bid.
• At least 5 years RMF lifecycle reporting experience.
• Experience reconciling hardware and software baselines.
• Experience with Windows, Linux and Apple networks.

Responsibilities

• Categorize ATC systems and define boundaries for RMF.
• Select security controls based on categorization and implement them.
• Assess controls and verify effectiveness.
• Support Security Control Assessor visits and IAVM compliance.
• Run continuous monitoring and POA&M upkeep.

Skills

RMF lifecycle

Documentation

Onsite work

Security engineering

Coordination with government staff

Education

CASP+/SecurityX or DoD 8570/8140 baseline

Tools

eMASS

Job description

Senior RMF Cybersecurity Engineer (Secret)

Hands-on RMF and authorization role. U.S. Army Aberdeen Test Center, Aberdeen Proving Ground, Maryland. Fully onsite.

Read this part first.

This job depends on CyberMyte winning the contract. The Army is buying this work through sealed bidding, and your resume goes in with our bid. The Army checks every resume against hard minimums, and one resume that misses a minimum can sink the whole bid. So before we submit, we need to confirm you meet every gate below, and we need your written permission and a signed letter of intent. The Army expects to award in November 2026. If we do not win, there is no job. We will tell you either way.

We are filling two seats. One starts when the contract starts. The other is a surge seat that the Army turns on when it needs it, so that start date is not fixed. We name both people in the bid. Tell us if you can only take a seat with a fixed start date.

What this job actually is

You keep ATC systems authorized. You work the RMF steps on Secret and below systems across four networks, alongside a senior architect who leads the team.

Roughly, and it will vary with the test schedule:

• Most of your time is RMF package work. Control implementation and assessment, evidence, POA&Ms, IAVM and continuous monitoring.
• A good share is inventory and baseline work. Reconciling hardware and software against the approved baseline and reviewing changes before they go in.
• The rest is supporting assessments. Getting ready for SCA visits, answering findings and keeping the documentation current.

This job is a good fit if

• You like the detail work of RMF and you are the person who knows which control a finding maps to.
• You can keep inventories and baselines accurate without someone chasing you.
• You write things down without being asked.

This job is not a good fit if

• You want remote or hybrid. Telework on this contract is situational only.
• You want a pure penetration testing or SOC role.
• You need a fixed start date and are applying for the surge seat.

About the contract

Aberdeen Test Center plans, runs and reports developmental and production tests for the Army, the rest of DoD and outside customers. It sits on roughly 70,000 acres of land and water at Aberdeen Proving Ground, with about 2,500 civilian, military and contractor staff.

The contract covers cybersecurity engineering and DoD Risk Management Framework support for four ATC networks: the ATC Local Area Network, the Logically Isolated Network, the Secure Test Environment and the Test and Evaluation Network. Secret and below systems follow DoDI 8510.01. Top Secret systems follow ICD 503. It is one base year plus four option years. The team is two core positions plus two surge positions the Army can turn on when it needs them. CyberMyte is bidding as the prime contractor.

Who directs your work. You report to CyberMyte. The ATC Contracting Officer's Representative and Technical Point of Contact are the Government's points of contact for the work itself, and you will coordinate with them and the ATC cybersecurity staff on technical priorities. Time, leave, schedule changes, task priority, pay and performance all run through CyberMyte.

Responsibilities

RMF lifecycle

• Categorize ATC systems and define system boundaries. Gather mission, roles, operating environment and interconnection information.
• Select security controls based on categorization, then implement them on the systems.
• Assess controls and run verification and validation to confirm they work as intended.
• Support Security Control Assessor visits, assessments and other authorization activities.
• Run continuous monitoring to keep each ATO current, including POA&M upkeep and IAVM compliance.

Engineering and configuration management

• Review proposed engineering changes to hardware and software baselines for security, performance and interoperability impact.
• Support configuration management and the review and control boards the Government runs.
• Analyze defects and incident reports in the defect tracking system and validate what was reported.
• Reconcile hardware and software inventories against the approved baseline.

Required qualifications

Citizenship, clearance and certification

• United States citizen. No exceptions for on-installation federal contract work.
• Active Secret clearance (Tier 3 investigation) when we submit the bid, held for the life of the contract, with the ability to hold a SIPRNet account.
• CASP+ (now SecurityX) or an equivalent DoD 8570/8140 baseline certification, held when we submit the bid. Personnel without current certification are denied access to DoD information systems. We cannot bid on a promise to certify later.

Technical experience

• At least 5 years supporting RMF lifecycle reporting.
• Experience with software and hardware reconciliation against an approved baseline.
• Working knowledge of DISA STIGs, NIST SP 800-53 and DoDI 8510.01.
• Experience managing networks across Windows, Linux and Apple platforms.
• Experience in both unclassified and classified environments, including Secret level systems.

Work style

• Able to work onsite with limited direct supervision from a standing task list.
• Documentation habits that do not require reminders.
• Comfortable coordinating with Government cybersecurity staff and system owners.

Preferred qualifications

• Experience with eMASS.
• Prior work at Aberdeen Proving Ground or another Army test and evaluation organization.
• CISSP.

How CyberMyte supports this role

We are making these commitments in writing because we learned they matter. We arrange everything below before your first day, not after.

• A written task list on day one. The Performance Work Statement spells out the tasks. You will have them in writing, with priorities, before you walk in.
• The tools to do the job. The Government provides workspace, laptops, program documents, archives and SOPs. We make sure you have them.
• A weekly check-in with company leadership. CyberMyte is small. You will have a direct line to the CEO, not three layers of management.
• Certifications paid, including renewals, and a $5,000 annual training stipend you direct yourself.

Schedule, environment and conditions

ATC works an alternate work schedule under ATC Regulation 690-9, and you work that schedule. Federal holidays are observed. Test support sometimes needs you outside normal hours, at designated ATC sites, with as little as one hour of notice. The contract is firm fixed price with a set number of hours per position, so after-hours work is offset with flexed hours rather than paid at a premium.

The work is fully onsite at Aberdeen Test Center. Telework is situational only, for things like weather closures or an installation closure, and only under a telework plan the COR has approved. The Government provides your workspace, laptop and network access. Reliable personal transportation to the installation is required. CyberMyte handles Army Account Validation System registration and base access processing before your start date. Within 30 days of starting, you complete Antiterrorism Level 1 training, the DoD Cybersecurity Awareness Challenge and the Army IT User Agreement.

Compensation and benefits

• Salary: $120,000 to $140,000 annually, based on experience and clearance status.
• Health: Individual Coverage Health Reimbursement Arrangement. CyberMyte funds a monthly tax-free allowance you direct toward the individual medical, dental and vision plan that fits your family.
• Retirement: 401(k) accepting employee contributions. An employer match is under evaluation for a future plan year and is not offered today.
• Bonus: Annual performance bonus based on individual contribution and company performance.
• Training: $5,000 annual stipend, directed by you. All job-related certifications and renewals reimbursed.
• Time off: Paid time off plus federal holidays.

CyberMyte, LLC is an Equal Opportunity Employer and a Service-Disabled Veteran-Owned Small Business. Veterans and transitioning service members are strongly encouraged to apply.