Senior RMF Security Controls Architect

Strategic Analysis, Inc.; Arlington (VA); On-site; USD 140,000 - 190,000; Full time

Job summary

Strategic Analysis, Inc. is seeking an experienced Senior Security Control Assessor (SCA) to support RMF activities, including assessment, authorization, and continuous monitoring of information systems in DoD/IC environments. The role focuses on evaluating security controls, identifying risks, and supporting authorization decisions.

Travel: Up to 50% travel required during the first year. Active TS/SCI w/ CI Poly or willingness to take and pass a CI Poly.

Qualifications

• 7+ years of cybersecurity experience supporting RMF/A&A activities.
• Previous experience in SCA, ISSM, ISSO, or ISSE roles.
• Strong working knowledge of Secure Systems & Cloud/AI/ML Environments and NIST RMF frameworks in advanced R&D portfolios.
• Experience with GRC/RMF tools such as XACTA, eMASS, or ServiceNow (SNOW).
• IAM Level III certification (CISM, CISSP, or GSLC).
• Ability to assess vulnerabilities, analyze risk, and document findings clearly.

Responsibilities

• Assess the effectiveness of security controls in accordance with RMF
• Perform security reviews to identify gaps in system architecture and design
• Conduct risk analysis and develop mitigation recommendations
• Execute security authorization reviews and support ATO decisions
• Validate security posture of systems, networks, and applications
• Monitor and evaluate compliance across information systems
• Develop Statements of Risk (SORs) and document security findings
• Provide authorization recommendations to the Authorizing Official (AO)

Skills

RMF/A&A expertise

SCA/ISSM/ISSO/ISSE experience

NIST RMF knowledge

Cloud/AI/ML security

GRC/RMF tools experience

IAM Level III certs

Security assessments

Tools

XACTA

eMASS

ServiceNow SNOW

Job description

Strategic Analysis, Inc. is seeking an experienced Senior Security Control Assessor (SCA) to support RMF activities, including assessment, authorization, and continuous monitoring of information systems in DoD/IC environments. The role focuses on evaluating security controls, identifying risks, and supporting authorization decisions.

Travel: Up to 50% travel required during the first year. Active TS/SCI w/ CI Poly or willingness to take and pass a CI Poly.