Pending Contract Award Mission Objectives - The Senior RMF Specialist/ISSO is responsible for the day-to-day execution of the Risk Management Framework (RMF) lifecycle for AMC's JWICS systems and enclaves. This position ensures that all required controls are implemented, assessed, documented, and monitored in eMASS to support AO risk decisions and maintain AMC's JWICS Authorization to Operate. Position Responsibility Summary - Lead the comprehensive RMF lifecycle management for assigned JWICS systems within the AMC eMASS portfolio, covering categorization, control selection/implementation, assessment, authorization, and continuous monitoring.
- Develop, maintain, and update system security documentation (e.g., SSPs, SARs, POA&Ms, security control traceability matrices, risk assessments) in accordance with DoD and Army RMF guidance.
- Collaborate with the P-ISSM, AO, AODRs, system owners, and ISSOs to optimize RMF workflows and coordinate approvals for system changes, boundary updates, and new capabilities.
- Implement and manage a robust continuous monitoring strategy, including vulnerability scanning, configuration management, control assessments, and security log reviews; ensure results are captured in eMASS and associated tools.
- Support cybersecurity assessments of JWICS computing environments to identify vulnerabilities and non-compliance with IA standards; recommend and track mitigations.
- Provide RMF and security engineering input to mission mapping and cyberspace terrain mapping activities, helping define authorization boundaries and risk posture.
- Produce timely RMF/eMASS updates and risk reports that enable AMC to meet QASP measures (e.g., =95% of priority systems with current eMASS status, =95% of identified gaps with recommended actions within 5 business days).
- Provide RMF and IA guidance to JWICS system administrators, Tier 1 support staff, and other technical personnel to ensure security considerations are built into day-to-day operations.
- Support cyber exercises and inspections/assessments (e.g., CCRIs, inspections by higher headquarters) by preparing RMF artifacts, responding to findings, and tracking corrective actions.
|