Cybersecurity Compliance and Risk Manager

Booz Allen Hamilton is seeking a Cybersecurity Compliance and Risk Manager to lead Risk Management Framework (RMF) execution and cybersecurity compliance across enterprise environments. In this onsite role in Tampa, Florida, you will apply and validate NIST SP 800-53 controls, support security authorization, and maintain continuous monitoring to improve security risk visibility. You will also conduct vulnerability assessment and risk analysis while partnering with clients and SMEs to communicate technical risk and mitigation options.

Role Overview

• Lead RMF execution, including security control attribution, documentation, assessment, and authorization.
• Implement and validate NIST SP 800-53 security controls across enterprise systems.
• Maintain continuous monitoring activities to support system compliance and ongoing risk visibility.
• Perform vulnerability assessments and risk analysis using DoD security tools such as ACAS, VRAM, and eMASS.
• Apply and verify DoD Security Technical Implementation Guidelines (STIGs) and Security Readiness Guidelines (SRGs) across software, database, and network environments.
• Manage enterprise POA&Ms to track and remediate security findings.
• Collaborate with clients and SMEs to develop mitigation strategies and clearly communicate technical risks and mitigation approaches.
• Provide guidance and mentorship to cybersecurity team members.

Requirements

• 3+ years of experience with DoD or USSOCOM cybersecurity and Risk Management Framework (RMF).
• 3+ years of experience with cyber vulnerability assessment, remediation, and mitigation tools, including ACAS, eMASS, and VRAM.
• 1+ years of experience working with DoD STIGs and SRGs.
• Experience with Microsoft Azure and AWS Cloud Service Providers.
• Experience developing and submitting Authority to Operate (ATO) packages.
• Experience implementing, documenting, assessing, and monitoring NIST SP 800-53 security controls, including drafting implementation or remediation statements into eMASS.
• Secret clearance.
• HS diploma or GED.
• Security+ Certification.
• DoD 8140 Certification such, CISM, CISSP, or SecurityX Certification.

Technologies

• Risk Management Framework (RMF)
• NIST SP 800-53
• ACAS
• VRAM
• eMASS
• DoD Security Technical Implementation Guidelines (STIGs)
• Security Readiness Guidelines (SRGs)
• POA&Ms
• Authority to Operate (ATO)
• Microsoft Azure
• AWS Cloud Service Providers
• Security+
• CISM, CISSP, SecurityX

Compensation and Location

• Location: Tampa, FL (onsite)
• Salary range: USD 86,800 - 198,000 per year

Benefits

• Health, life, disability, financial, and retirement benefits
• Paid leave
• Professional development
• Tuition assistance
• Work-life programs
• Dependent care
• Recognition awards program
• Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs

Clearance and Screening

• Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Secret clearance is required.

Identity Verification and Interview Rules

• During the hiring process, an identity verification process leveraging advanced biometrics and artificial intelligence will be used to ensure authenticity and protect against identity fraud.
• You are expected to be on camera during interviews and assessments.
• Booz Allen reserves the right to take your picture to verify your identity and prevent fraud.
• Use of artificial intelligence (AI) or other tools to assist with responses during interviews (in-person or virtual) is prohibited unless permission is explicitly provided.

Work Model

• Onsite: Work will primarily be performed full-time at a customer facility, where employees will collaborate directly with colleagues and customers as required by the role.

Non-Discrimination

• All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, local, or international law.