Cybersecurity Engineer / RMF Specialist

Cybersecurity Engineer / RMF Specialist role supporting a federal customer to document, assess, and strengthen cybersecurity posture for building and facility control systems to achieve and maintain an Authority to Operate (ATO).

Responsibilities

• Develop and maintain RMF documentation and security artifacts, including system diagrams, security categorization documents, control implementation narratives, and POA&Ms.
• Collect, consolidate, validate, and organize technical information from system owners, engineers, and operations personnel into audit-ready deliverables.
• Support system categorization and risk assessment activities by preparing documentation and tracking stakeholder inputs.
• Review vulnerability scan results, document findings, develop remediation plans and POA&Ms, and track actions through closure.
• Assist with STIG and security control checklist work, including compliance status and exception handling.
• Maintain accurate inventories of in-scope hardware, software, and supporting documentation.
• Coordinate with the Government’s remote cybersecurity team, program managers, security officers, engineers, and vendors to ensure artifacts align with enterprise expectations.
• Contribute to monthly reporting and recurring customer deliverables within required deadlines and formats.
• Support phase-in and transition efforts, including obtaining and validating documentation from the outgoing team.

Requirements

• DoD 8140.03 certification requirements for this role (IAM Level I), such as Security+ CE.
• Role-based computing environment certification must be obtained before privileged access, within 180 days of the first day of employment.
• Hands-on experience supporting the RMF process in a federal, DoD, or similarly complex environment.
• Experience producing security documentation and artifacts reviewed by a Government ISSM, auditor, or authorizing official.
• Working knowledge of FIPS 199/200, NIST SP 800-53, NIST SP 800-82, and CNSSI 1253.
• Familiarity with DoD vulnerability scanning and compliance tools (e.g., ACAS, SCAP) and ability to interpret output.
• Ability to translate technical input into clear, defensible security documentation and coordinate with diverse stakeholders.
• US Citizenship with the ability to obtain and maintain a Secret security clearance.
• Bachelor’s degree preferred but not required; equivalent experience, technical training, military service, or relevant industry certifications will be considered.

Technologies

• RMF
• Security+ CE
• DoD 8140.03
• FIPS 199, FIPS 200
• NIST SP 800-53, NIST SP 800-82
• CNSSI 1253
• STIG
• eMASS (or similar RMF package management system), including PIA/PRiLA
• ACAS, SCAP
• Purdue Enterprise Reference Architecture
• FedRAMP
• Zero Trust

Preferred Skills

• Experience uploading and maintaining artifacts in eMASS or a similar RMF package management system.
• Experience with OT, ICS, SCADA, or facility-related control systems, including building automation or advanced metering.
• Knowledge of the Purdue Enterprise Reference Architecture.
• Experience supporting ATO or Authority to Connect (ATC) efforts from initiation through completion.
• Familiarity with FedRAMP and Zero Trust principles.
• Experience with privacy documentation (PIA/PRiLA) or contingency planning artifacts.
• Prior Defense Logistics Agency (DLA) customer experience.