Zero Trust A&A Analyst — RMF/NIST Expert

Gunnison Consulting Group; Bethesda, Northern (MD, KY); Hybrid; USD 60,000 - 71,000; Full time

Benefits offered by this job

3 weeks Personal Leave

11 paid Holidays

5 days Flexible Time Off

401(k) company match 50% up to 10%

Medical, Dental and Vision Insurance

Life and Disability Insurance

Public Transportation Subsidies

Certifications and Training Allowance

Job summary

Gunnison Consulting Group seeks an A&A Analyst to map NIH FISMA systems to Zero Trust controls within the OCIO ZTA framework. The role involves CSAM inventory, evidence gathering, and remediation planning across three authorization tiers.

Responsibilities include scoring gaps, maintaining the ZTA library, and creating SSP/SAP/SAR packages while ensuring records remain current for the NIH program. Requires federal RMF/A&A experience and relevant certifications.

Qualifications

• US Citizenship required.
• 4+ years of RMF/A&A experience in a federal environment.
• Working knowledge of NIST SP 800-37 Rev 2, 800-53 Rev 5, 800-53A, and FISMA.
• Hands-on POA&M management and experience with CSAM or a comparable GRC tool.
• Bachelor's degree.
• Security+ or CAP/CGRC certification.

Responsibilities

• Pull the CSAM inventory and map the control set of each NIH FISMA system against the Centrally Provided Services Matrix.
• Identify inherited, hybrid, and uncovered controls for mapping and remediation.
• Score residual gaps by FIPS 199 impact, data sensitivity, and internet exposure.
• Build ZTA Overlay mappings and evidence expectations; tag controls as central, hybrid, or system-specific.
• Maintain records in the NIH ZTA control library and support the three-system pilot.
• Develop SSP, SAP/SAR, and POA&M templates and continuous-monitoring cadences for three authorization tiers.

Skills

RMF/A&A experience

Education

Bachelor's degree

Security+ or CAP/CGRC certification

Tools

CSAM

Xacta

RSA/SGRC Archer

ServiceNow

Excel

Power BI

Confluence/SharePoint

Job description

Gunnison Consulting Group seeks an A&A Analyst to map NIH FISMA systems to Zero Trust controls within the OCIO ZTA framework. The role involves CSAM inventory, evidence gathering, and remediation planning across three authorization tiers.

Responsibilities include scoring gaps, maintaining the ZTA library, and creating SSP/SAP/SAR packages while ensuring records remain current for the NIH program. Requires federal RMF/A&A experience and relevant certifications.