SCOPE: As an US Citizen, the Sr. Security RMF Audit Analyst will lead audit preparation and execution, support continuous RMF lifecycle activities, and oversee compliance with federal cybersecurity requirements across on-premises, virtual, and cloud-hosted systems.
REQUIRED SKILLS:
Bachelor’s or Associate's degree in Computer Science, Math, Information Technology, Engineering, or related field.
Two (2) years of directly relevant experience may substitute for one (1) year of formal education.
CompTIA Security+ required
Minimum of five (5) years of experience in Information security with auditing and IT controls design experience.
Minimum of five (5) years of experience with Security Information and Event Management (SIEM).
Minimum of five (5) years of experience in the risk management framework.
Hands-on experience with Active Directory, Windows/UNIX systems, and relational databases in secure environments.
Advanced knowledge of NIST RMF, NIST SP 800-37, 800-53, DHS 4300A, and FISMA compliance.
Experience preparing and maintaining RMF ATO documentation and conducting system assessments.
Familiarity with Security Information and Event Management (SIEM) platforms for log analysis and incident monitoring.
Proficient in evaluating and documenting security configurations and technical implementations for federal systems.
Strong understanding of cybersecurity audit workflows, control testing, and risk-based prioritization of vulnerabilities.
Excellent writing and communication skills, capable of producing technical documentation and executive summaries.
Experience in Agile or DevSecOps environments, with a strong understanding of security integration within CI/CD pipelines.
Job Responsibilities
TASKS:
Oversee the Risk Management Framework (RMF) lifecycle, including assessment, authorization, and continuous monitoring across all ALC-ISD systems.
Lead and coordinate internal and external cybersecurity audits, including pre-audit readiness assessments and post-audit remediation tracking.
Validate the implementation of security controls (NIST SP 800-53 Rev. 5) and ensure they are effectively documented within System Security Plans (SSPs), Security Assessment Reports (SARs), and related artifacts.
Design and implement vulnerability management strategies, assess threat vectors, and develop comprehensive Plans of Action and Milestones (POA&Ms).
Analyze cyber risks and provide guidance on remediation strategies aligned with DHS policy and evolving cybersecurity threats.
Perform and document risk assessments, penetration testing coordination, and impact analyses to evaluate the security posture of information systems.
Collaborate with Security Control Assessors (SCAs), engineers, ISSOs, and DevSecOps teams to ensure audit alignment with enterprise system modernization efforts.
Manage and maintain audit packages, compliance dashboards, and evidence repositories using platforms like Jira, Confluence, and SharePoint.
Assess and validate configurations of infrastructure (e.g., Windows, Linux, databases, Active Directory) for compliance with security benchmarks (e.g., DISA STIGs, CIS).
Draft and update security-related documentation including SOPs, incident response plans, and security test procedures.
Serve as a subject matter expert to stakeholders on RMF best practices, ATO sustainment, and security documentation management.
All other duties as assigned by management.
Numbers & Facts
Location
(Remote)
Job Type
Contractor
Salary
$30–$38 Per Hour
Qualifications
PREFERRED SKILLS:
Previous support of federal government enterprise systems or DHS/DOD programs is strongly preferred.
Additional certifications (Network+, AWS Certified Cloud Practitioner, Microsoft Azure Fundamentals, Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), ITIL Foundation, TOGAF, or other cybersecurity architecture certifications) are a plus.
Skills
Agile Programming Methodologiesunmatched
Analysis Skillsunmatched
Cloud Computingunmatched
Communication Skillsunmatched
CompTIA Security+unmatched
Computer Scienceunmatched
Computer Securityunmatched
Continuous Deployment/Deliveryunmatched
Continuous Integrationunmatched
Design Servicesunmatched
Documentationunmatched
Establish Prioritiesunmatched
FISMA - Federal Information Security Management Actunmatched
Federal Compliance Regulationsunmatched
Homeland Securityunmatched
Information Technology & Information Systemsunmatched
Information Technology/Systems Auditunmatched
Information/Data Security (InfoSec)unmatched
Internet Securityunmatched
Maintain Complianceunmatched
Mathematicsunmatched
Microsoft Active Directoryunmatched
Relational Databases (RDBMS)unmatched
Risk Managementunmatched
Risk Management Framework (RMF)unmatched
Security Analysisunmatched
Security Auditingunmatched
Security Information and Event Management (SIEM)unmatched
Systems Analysisunmatched
Technical Writingunmatched
U.S. National Institute of Standards and Technology (NIST)unmatched
United States Citizenunmatched
Unix Operating Systemsunmatched
Writing Skillsunmatched
🎯
Be found by employers
5,500+ employers search our resume database daily. Add yours to get found by recruiters looking for candidates like you.
Level up your application
Professional resume templates
Browse dozens of recruiter approved resume templates, layouts and formats. Choose your favorite and make it your own in minutes.