Senior RMF Security Analyst

Cybersecurity Jobs; Gaithersburg (MD); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Diligent Solutions is seeking a Senior RMF Security Analyst to support federal information systems through RMF Steps 1–3. In this hands‑on role, you will develop and maintain RMF security documentation to help systems achieve, maintain, and renew Authorities to Operate (ATOs).

This position is based in Gaithersburg, MD on a hybrid schedule, with work focused on producing accurate, complete, and review‑ready authorization package artifacts.

Qualifications

• Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
• Hands-on experience developing and maintaining federal A&A and authorization packages.
• Strong technical-writing skills with ability to produce Section 508-compliant documentation.

Responsibilities

• Collect and update general system information for federal RMF documentation.
• Create and maintain system records in CSAM, including system identification information and technical narratives.
• Prepare and update PTAs and PIAs.
• Perform and update FIPS 199 security categorizations.
• Develop and update documentation for NIST SP 800-53 controls.
• Coordinate with stakeholders to ensure RMF documentation is accurate and ready for review.
• Assist government stakeholders with addressing findings during concurrence and authorization reviews.

Skills

RMF knowledge

Technical writing

CSAM

A&A documentation

FedRAMP knowledge

NIST SP 800-53 Rev.4/5

NIST SP 800-37 Rev. 2

NIST SP 800-171 Rev. 2

NIST SP 800-47 Rev. 1

Privacy documentation

Education

Bachelor’s degree

Tools

CSAM

Job description

Diligent Solutions is seeking a Senior RMF Security Analyst to support federal information systems through RMF Steps 1–3. In this hands‑on role, you will develop and maintain RMF security documentation to help systems achieve, maintain, and renew Authorities to Operate (ATOs).

This position is based in Gaithersburg, MD on a hybrid schedule, with work focused on producing accurate, complete, and review‑ready authorization package artifacts.

Key Responsibilities

• Collect and update general system information for federal RMF documentation.
• Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
• Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
• Perform and update FIPS 199 security categorizations.
• Perform and update E-Authentication Risk Assessments.
• Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
• Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
• Develop and update compensating controls when required.
• Develop and update Contingency Plans and related testing and training documentation.
• Develop and update documentation including System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
• Finalize System Security Plan compliance descriptions.
• Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
• Assist government stakeholders with addressing findings and updating documentation during concurrence and authorization reviews.
• Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.

Requirements

• U.S. citizenship.
• Bachelor’s degree and at least eight years of relevant cybersecurity experience.
• Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
• Hands‑on experience developing and maintaining federal A&A and authorization packages.
• Working knowledge of the NIST Risk Management Framework.
• Working knowledge of FIPS PUB 199.
• Working knowledge of NIST SP 800-53 Rev. 4 and/or Rev. 5.
• Working knowledge of NIST SP 800-37 Rev. 2.
• Working knowledge of NIST SP 800-171 Rev. 2.
• Working knowledge of NIST SP 800-47 Rev. 1.
• Working knowledge of other publications and guidance related to the federal RMF process.
• Hands‑on experience using Cybersecurity Assessment and Management System (CSAM).
• Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
• Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
• Strong technical‑writing skills, with the ability to produce accurate, complete, and Section 508‑compliant documentation.
• Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
• Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.

Technology and Standards

• Cybersecurity Assessment and Management System (CSAM)
• FedRAMP
• NIST Risk Management Framework
• FIPS PUB 199
• NIST SP 800-53 Rev. 4 and NIST SP 800-53 Rev. 5
• NIST SP 800-37 Rev. 2
• NIST SP 800-171 Rev. 2
• NIST SP 800-47 Rev. 1
• Section 508

Location

• Hybrid (Beltsville, Maryland)

Preferred Qualifications

• Prior federal civilian‑agency A&A experience.
• Prior USDA cybersecurity or RMF experience is a plus.
• Experience with the USDA Six‑Step RMF Process or USDA CSAM instance is a strong plus.
• Experience independently supporting RMF activities across multiple federal information systems.
• Active certification such as CISSP, CGRC (formerly CAP), or CISM.
• Current or prior federal Public Trust investigation.