Cybersecurity Engineer - DoD RMF & Authorization

The ideal candidate is a cybersecurity professional with substantial experience supporting DoD RMF authorization activities and a strong technical foundation in systems and network security.

This individual understands how to develop and maintain technically accurate RMF packages, interpret security control requirements, and coordinate authorization activities with engineering teams and government stakeholders.

Beyond documentation, the successful candidate will be able to examine system configurations, understand network architectures, interpret vulnerability assessment results, and determine whether security controls are appropriately implemented.

We are seeking someone who can independently drive RMF activities, identify potential authorization challenges, and work proactively with engineering teams to resolve technical and compliance issues.

Candidates should be comfortable operating in dynamic engineering environments where systems evolve throughout development, testing, and deployment.

Duties and Responsibilities

• Lead and support the execution of the Department of Defense (DoD) Risk Management Framework (RMF) process for information systems throughout development, testing, authorization, and operational lifecycles.
• Develop, maintain, and manage complete RMF authorization packages supporting Authorizations to Operate (ATOs), Interim Authorizations to Test (IATTs), and ongoing system authorization activities.
• Prepare and maintain System Security Plans (SSPs), security control implementation statements, Plans of Action and Milestones (POA&Ms), hardware and software inventories, system architecture documentation, and other required RMF artifacts.
• Manage RMF authorization packages within Enterprise Mission Assurance Support Service (eMASS), ensuring security control documentation, assessment evidence, and supporting artifacts are accurate, complete, and maintained throughout the authorization lifecycle.
• Analyze and document security control implementations in accordance with NIST SP 800-53, DoDI 8510.01, CNSSI 1253, applicable DISA Security Technical Implementation Guides (STIGs), and DoD cybersecurity policies.
• Coordinate with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), Security Control Assessors (SCAs), Authorizing Officials (AOs), and government representatives to support security assessments and authorization decisions.
• Evaluate system architectures, configurations, and operational environments to determine security control applicability, implementation approaches, and compliance requirements.
• Review and interpret vulnerability assessment results from ACAS, Nessus, SCAP, and STIG compliance assessments to identify security deficiencies, document associated risks, and develop remediation recommendations.
• Develop, maintain, and track POA&Ms, coordinating with engineering teams to resolve identified vulnerabilities, document mitigating factors, and support risk acceptance decisions.
• Support Security Control Assessment (SCA) activities by preparing assessment evidence, responding to findings, coordinating technical demonstrations, and resolving documentation deficiencies.
• Develop and execute continuous monitoring activities to maintain the cybersecurity posture and authorization status of assigned information systems.
• Assess proposed system modifications, software updates, and configuration changes to determine their impact on security controls, authorization boundaries, and existing ATO/IATT conditions.
• Collaborate directly with systems, software, and network engineers to ensure cybersecurity requirements are incorporated into system design, development, integration, and testing activities.
• Provide technical guidance on secure configurations, operating system hardening, network security, virtualization, and vulnerability remediation to support compliance with DoD cybersecurity requirements.

Requirements

• 6–8 years of professional experience in DoD cybersecurity, information assurance, systems administration, network engineering, or related technical disciplines.
• Demonstrated experience supporting DoD RMF authorization activities, including development and maintenance of ATO and/or IATT packages.
• Hands-on experience developing and maintaining RMF documentation, including SSPs, security control implementation statements, POA&Ms, and supporting assessment artifacts.
• Experience utilizing eMASS to document security controls, manage authorization artifacts, track assessment findings, and maintain RMF packages.
• Strong working knowledge of NIST SP 800-53, DoD RMF requirements, and security control implementation and assessment methodologies.
• Experience interpreting DISA STIG requirements, vulnerability assessment results, and system security configurations to determine compliance and develop remediation recommendations.
• Experience reviewing technical system configurations, network architectures, and security control implementations to support accurate RMF documentation.
• Working knowledge of Linux and Windows operating systems, including system administration, security hardening, access controls, and configuration management.
• Familiarity with virtualized environments such as VMware, KVM, or Hyper-V and their associated cybersecurity considerations.
• Understanding of networking fundamentals, including TCP/IP, VLANs, subnets, firewalls, routing, network segmentation, and secure communications.
• Ability to analyze cybersecurity findings, document technical risks, and communicate remediation requirements to engineering teams and government stakeholders.
• Strong technical writing skills with demonstrated ability to produce clear, accurate, and technically defensible security documentation.
• Ability to independently manage multiple RMF deliverables, coordinate across engineering disciplines, and meet program authorization milestones.
• Ability to meet applicable DoD 8140 cybersecurity workforce qualification requirements for the assigned work role.
• U.S. citizenship.
• Active Secret security clearance.

Preferred Qualifications

• Experience independently managing DoD RMF authorization packages from initial system categorization through authorization and continuous monitoring.
• Experience supporting successful ATO/IATT submissions, security assessments, and authorization package reviews.
• Familiarity with Navy, Marine Corps, or Air Force RMF authorization processes and service-specific requirements.
• Experience supporting cybersecurity accreditation of Research, Development, Test, and Evaluation (RDT&E) systems, developmental systems, or operational DoD capabilities.
• Experience coordinating directly with SCAs, AOs, government ISSMs, and other authorization stakeholders.
• Experience performing security control inheritance analysis, developing system authorization boundaries, and identifying applicable overlays and control tailoring requirements.
• Experience using ACAS, Nessus, SCAP, STIG Viewer, and other vulnerability assessment or compliance tools.
• Experience with technical implementation of DISA STIGs and security hardening of Linux, Windows, networking equipment, and virtualized environments.
• Familiarity with DoDI 8510.01, NIST SP 800-37, CNSSI 1253, and applicable DoD continuous monitoring guidance.
• Knowledge of Navy Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) systems, military networks, or tactical data links.
• Experience supporting cybersecurity requirements within Agile software development or systems engineering environments.
• Experience assessing cybersecurity risks associated with custom software, specialized hardware, or mission-specific system architectures.