Gaithersburg, MD

Cybersecurity Jobs in Gaithersburg, MD

2 jobs found

Include remote jobs

Today

Senior RMF Security Analyst

Diligent Solutions Gaithersburg, MD

Gaithersburg, MD

Today

Full time Senior Data Security Facilities Management

Apply Now

Job Description

Diligent Solutions is seeking a Senior RMF Security Analyst to support federal information systems through RMF Steps 1–3. In this hands-on role, you will develop and maintain RMF security documentation to help systems achieve, maintain, and renew Authorities to Operate (ATOs).

This position is based in Gaithersburg, MD on a hybrid schedule, with work focused on producing accurate, complete, and review-ready authorization package artifacts.

Key Responsibilities

Collect and update general system information for federal RMF documentation.
Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
Perform and update FIPS 199 security categorizations.
Perform and update E-Authentication Risk Assessments.
Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
Develop and update compensating controls when required.
Develop and update Contingency Plans and related testing and training documentation.
Develop and update documentation including System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
Finalize System Security Plan compliance descriptions.
Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
Assist government stakeholders with addressing findings and updating documentation during concurrence and authorization reviews.
Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.

Requirements

U.S. citizenship.
Bachelor’s degree and at least eight years of relevant cybersecurity experience.
Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
Hands-on experience developing and maintaining federal A&A and authorization packages.
Working knowledge of the NIST Risk Management Framework.
Working knowledge of FIPS PUB 199.
Working knowledge of NIST SP 800-53 Rev. 4 and/or Rev. 5.
Working knowledge of NIST SP 800-37 Rev. 2.
Working knowledge of NIST SP 800-171 Rev. 2.
Working knowledge of NIST SP 800-47 Rev. 1.
Working knowledge of other publications and guidance related to the federal RMF process.
Hands-on experience using Cybersecurity Assessment and Management System (CSAM).
Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
Strong technical-writing skills, with the ability to produce accurate, complete, and Section 508-compliant documentation.
Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.

Technology and Standards

Cybersecurity Assessment and Management System (CSAM)
FedRAMP
NIST Risk Management Framework
FIPS PUB 199
NIST SP 800-53 Rev. 4 and NIST SP 800-53 Rev. 5
NIST SP 800-37 Rev. 2
NIST SP 800-171 Rev. 2
NIST SP 800-47 Rev. 1
Section 508

Location

Hybrid (Beltsville, Maryland)

Preferred Qualifications

Prior federal civilian-agency A&A experience.
Prior USDA cybersecurity or RMF experience is a plus.
Experience with the USDA Six-Step RMF Process or USDA CSAM instance is a strong plus.
Experience independently supporting RMF activities across multiple federal information systems.
Active certification such as CISSP, CGRC (formerly CAP), or CISM.
Current or prior federal Public Trust investigation.

View full job page →

1mo ago

Penetration Tester

Connsci Gaithersburg, MD

Gaithersburg, MD

1mo ago Closed

$100k - $130k/yr Full time Application Security Cloud Platforms Compliance Testing

This position is no longer accepting applications (closed Sep 12, 2026).

Job Description

Connsci is seeking a Penetration Tester to support a government program through hands-on penetration testing, vulnerability and compliance testing, and audit and reporting activities. This position is primarily remote, with travel required on an as-needed basis across Florida and the Washington DC metro region.

Role Overview

The Penetration Tester will perform security testing across networks, systems, endpoints, and cloud environments, with an emphasis on web application, API, and control validation. Responsibilities include documenting findings, preparing audit evidence, and providing recommendations to improve governance, risk, and compliance posture.

Responsibilities

Conduct authenticated vulnerability scans and compliance evaluations across networks, systems, endpoints, and cloud platforms.
Assess agency web applications using OWASP Top 10 and industry best practices.
Perform authenticated and unauthenticated scanning activities using tools such as Burp Suite and OWASP ZAP.
Identify vulnerabilities including injection flaws, authentication weaknesses, session mismanagement, and sensitive data exposure.
Validate application security controls against NIST CSF subcategories.
Evaluate REST and GraphQL APIs for authentication, authorization, and input validation weaknesses.
Conduct fuzzing and misuse testing to identify broken object-level authorization (BOLA) and mass assignment vulnerabilities.
Assess security of API tokens, keys, and session management practices.
Review error handling, data leakage, and logging practices to support compliance requirements.
Execute controlled penetration testing (internal and external) to simulate adversary behaviors and assess defensive effectiveness.
Document findings, prepare audit evidence, and provide recommendations for improving governance, risk, and compliance posture.
Provide technical assistance to Agency OIGs and coordinate with operational IT and security teams to ensure findings are actionable and evidence-based.

Required Qualifications

Bachelor's degree in Cybersecurity, Information Systems, or a related field, or equivalent experience.
At least 5 years of penetration testing experience, including web application testing and API testing.
At least 2 years supporting audit, compliance, or oversight functions, including preparing audit-ready documentation, evidence, and reports for executive leadership.
At least 2 years experience with NIST Cybersecurity Framework, including NIST 800-53.
At least one cybersecurity certification, such as CISSP, CISA, CISM, CCE, CFCE, GCFE, or CEH.

Technology & Tools

OWASP Top 10
Burp Suite
OWASP ZAP
NIST CSF
NIST 800-53
REST
GraphQL
BOLA

Location and Travel

Primarily remote work.
As-needed travel to company and government client site locations across Florida and the Washington DC metro region.
Preference for candidates local to the DC Metro Region or who reside in Florida.

Preferred Qualifications

Master's degree in Cybersecurity, Information Technology, or Computer Science.
7+ years of experience in penetration testing.
3+ years of experience with cloud technologies and Cloud Security Posture Management.

Compensation

USD 100,000 - 130,000 per year.

View full job page →

Cybersecurity Jobs in Gaithersburg, MD

Senior RMF Security Analyst

Penetration Tester

Get Cybersecurity Jobs in Gaithersburg, MD alerts