Cybersecurity Engineer / RMF Specialist

Agile Defense is seeking a Cybersecurity Engineer / RMF Specialist to support a federal customer by documenting, assessing, and strengthening the security posture of building and facility control systems. This role is documentation and assessment focused within a small onsite cyber team, helping the customer achieve and maintain an Authority to Operate (ATO) through the RMF process.

Key Responsibilities

• Develop and maintain RMF documentation and security artifacts, including system diagrams, system categorization documents, control implementation write-ups, and plans of action.
• Collect, consolidate, and organize technical information provided by system owners, engineers, and operations staff into audit-ready deliverables.
• Support system categorization and risk assessment activities by preparing required documentation and tracking stakeholder inputs.
• Review vulnerability scan results and create remediation plans (POA&Ms), tracking progress through to closure.
• Assist with STIG and security control checklists by documenting compliance status and any exceptions.
• Maintain accurate inventories of in-scope hardware, software, and documentation.
• Coordinate with the government remote cybersecurity team, program managers, and security officers to ensure artifacts meet enterprise expectations.
• Provide timely monthly reporting and recurring customer deliverables in the required format.
• Support ramp-up phase activities, including capturing and validating documentation from the outgoing team.

Required Qualifications

• Meet DoD 8140.03 certification requirements for this role (IAM Level I), such as Security+ CE.
• Complete role-based computing environment certification before privileged access within 180 days of the first day.
• Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment.
• Experience producing security documentation and artifacts reviewed by a government ISSM, auditor, or authorizing official.
• Bachelor’s degree is not required; candidates with equivalent experience, technical training, or industry certifications will be considered.
• Working knowledge of federal cybersecurity frameworks including FIPS 199/200, NIST 800-53, NIST 800-82, and CNSSI 1253.
• Familiarity with DoD cybersecurity tools for vulnerability scanning and compliance checking (including ACAS and SCAP) and the ability to interpret outputs.
• Strong written communication to convert technical input from engineers and operators into clear, defensible documentation.
• Attention to detail and the ability to manage multiple deliverables with overlapping deadlines.
• Ability to coordinate with program managers, remote cybersecurity stakeholders, security officers, engineers, and vendors to obtain required inputs.
• US Citizenship and the ability to obtain and maintain a Secret security clearance.

Technologies and Frameworks

RMF, DoD 8140.03, Security+ CE, FIPS 199/200, NIST 800-53, NIST 800-82, CNSSI 1253, ACAS, SCAP, STIG, eMASS, Purdue Enterprise Reference Architecture, FedRAMP, Zero Trust, PIA/PRiLA

Preferred Qualifications

• Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system.
• Experience supporting OT/ICS/SCADA or facility related control systems (for example, building automation and advanced metering).
• Knowledge of the Purdue Enterprise Reference Architecture.
• Experience supporting ATO or ATC efforts from start to finish.
• Familiarity with FedRAMP and Zero Trust principles.
• Experience with privacy documentation (PIA/PRiLA) or contingency plan artifacts.
• Prior DLA customer experience.

Location

Columbus, OH | Onsite