Assessment and Authorization (A&A) Lead
NTT DATA North America · Rockville, MD · 1 mo ago
Education$110k–$184k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes job summary, duties, qualifications, benefits, pay, schedule? There's no explicit schedule. Pay is given: starting pay range $110,179 - $183,631. Benefits described. So we need sections: maybe "Job Summary" as About the role? The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to map content accordingly.
We have:
- Job Summary: description of role, leading team, etc. Could be under "About the role" or maybe "Job Summary". The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should use those headings if content exists.
We have responsibilities/duties: list of duties. So we can put under
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to map content accordingly.
We have:
- Job Summary: description of role, leading team, etc. Could be under "About the role" or maybe "Job Summary". The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should use those headings if content exists.
We have responsibilities/duties: list of duties. So we can put under Responsibilities
with - .
We have qualifications: basic qualifications and preferred qualifications. Could be under
Requirements
or Qualifications
. The instruction includes both Requirements and Qualifications as possible headings. We need to decide. Probably combine basic qualifications under Requirements, and preferred under Qualifications? Or we could have Requirements for basic qualifications, Qualifications for preferred. Let's do that.
Skills: maybe we can extract from preferred qualifications: leadership, analytical, etc. Could be under Skills.
Benefits: described.
Pay: given.
Schedule: not mentioned, so omit.
We must not repeat job title as heading. No Job ID.
We must remove boilerplate: EEO, legal, etc.
We must preserve all substantive information.
Let's extract content.
Job Summary paragraph: "NTT DATA is seeking an experienced Assessment and Authorization (A&A) Lead to oversee cybersecurity assessment, authorization, and continuous monitoring activities for federal information systems. The successful candidate will possess strong knowledge of the NIST Risk Management Framework (RMF), federal security requirements, and the complete Authorization to Operate (ATO) lifecycle. This position will lead and manage a team of approximately five to eight Security Control Assessors, Information System Security Officers (ISSOs), and other cybersecurity professionals. The A&A Lead will be responsible for ensuring that security authorization packages are accurate, complete, compliant, and delivered according to established schedules. The A&A Lead must be a hands-on leader who can establish priorities, assign responsibilities, remove obstacles, coach team members, and maintain high-quality deliverables. The individual must be comfortable engaging directly with senior government stakeholders, presenting authorization risks, and recommending practical solutions that balance mission requirements with cybersecurity compliance."
That's the summary.
Responsibilities: list from "Job Duties:" bullet points.
Let's extract each duty:
- Lead the end-to-end A&A and ATO process for federal information systems.
- Manage and mentor a team of five to eight Security Control Assessors and ISSOs.
- Develop and maintain integrated ATO schedules, milestones, priorities, and resource assignments.
- Coordinate security authorization activities with system owners, technical teams, ISSOs, assessors, authorizing officials, and other stakeholders.
- Apply the NIST Risk Management Framework throughout the system development and authorization lifecycle.
- Review and validate security authorization documentation, including:
System Security Plans
Security Assessment Plans
Security Assessment Reports
Plans of Action and Milestones
Risk assessments
Contingency plans
Continuous monitoring plans
Security control implementation evidence
- Oversee security control assessments and ensure findings are clearly documented, supported by evidence, and assigned appropriate risk ratings.
- Evaluate system vulnerabilities, control deficiencies, and residual risks to support authorization decisions.
- Monitor remediation activities and ensure POA&M items are properly documented, tracked, updated, and closed.
- Conduct quality assurance reviews of A&A packages before submission to the Authorizing Official.
- Identify risks, schedule delays, documentation gaps, and resource constraints and communicate them to program leadership.
- Establish standardized A&A procedures, templates, checklists, and quality-control processes.
- Facilitate status meetings, risk-review sessions, and authorization-readiness reviews.
- Support continuous monitoring, annual assessments, significant-change reviews, and authorization renewals.
- Prepare executive-level dashboards, metrics, and reports describing ATO status, risks, findings, and remediation progress.
- Provide guidance to system teams on federal cybersecurity policies, control implementation, and compliance expectations.
- Promote accountability, collaboration, and consistent performance across the A&A team.
We need to format as - . For the nested list under "Review and validate security authorization documentation, including:" we could either make a sublist or just include as part of the li text. Probably better to keep as part of li text with commas or semicolons. But we could also make a sublist. The instruction didn't forbid sublists. Use
- for any list of duties/requirements/benefits. So we can have a top-level ul for duties, and inside a duty we can have another ul for the subitems. That's fine.
Requirements (basic qualifications): list:
- Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline.
- Minimum 8 years of cybersecurity, information assurance, or information system security experience.
- Minimum 5 years of experience supporting federal A&A, ATO, or NIST RMF activities.
- Minimum 5 years of experience managing or leading teams of Security Control Assessors, ISSOs, or cybersecurity analysts.
- Minimum 5 years of experience to include:
NIST Risk Management Framework
NIST SP 800-37
NIST SP 800-53
NIST SP 800-53A
NIST SP 800-30
FISMA requirements
Federal continuous monitoring practices
- Minimum 5 years of experience reviewing complex security authorization packages and evaluating security control evidence.
- Minimum 5 years of experience of security risk management, vulnerability management, POA&M management, and continuous monitoring.
- Candidates must hold at least one of the following active certifications:
Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
We could format as ul.
Qualifications (preferred): list:
- Experience supporting cybersecurity programs within NIH, HHS, or another federal civilian agency.
- Experience with federal governance, risk, and compliance platforms such as CSAM, JCAM, ServiceNow GRC, or similar tools.
- Experience managing a portfolio of systems with concurrent ATO deadlines.
- Familiarity with cloud security requirements, including FedRAMP and NIST controls for AWS, Microsoft Azure, or other cloud environments.
- Experience developing A&A standard operating procedures, playbooks, templates, and performance metrics.
- Additional certifications such as CAP/CGRC, CRISC, CCSP, PMP, or Security+.
- Experience supporting high-impact or mission-critical federal information systems.
- Strong leadership, analytical, organizational, and problem-solving skills.
- Excellent written and verbal communication skills, including the ability to communicate technical risks to executive and nontechnical stakeholders.
- Ability to work effectively with government leadership, system owners, engineers, cybersecurity teams, and third-party assessors.
We could split skills: leadership etc. But we can keep under Qualifications.
Skills: maybe we can extract leadership etc. But we already have them in Qualifications. Could create a Skills section for those soft skills. However instruction says prefer few substantive sections over many thin ones. So maybe we combine preferred qualifications and skills into Qualifications. Or we could have Qualifications for hard requirements and Skills for soft skills. Let's decide: We'll have Requirements (basic qualifications) and Qualifications (preferred + skills). That seems reasonable.
Benefits: list:
- medical, dental, and vision insurance with an employer contribution
- flexible spending or health savings account
- life and AD&D insurance
- short and long term disability coverage
- paid time off
- employee assistance
- participation in a 401k program with company match
- additional voluntary or legally-required benefits
Pay: starting pay range $110,179 - $183,631. Also mention incentive compensation eligibility.
We need to include that actual compensation depends on factors, incentive compensation based on performance, if temporary not eligible. We'll include as prose under Pay.
Schedule: not present, omit.
Now produce HTML fragment with
headings and appropriate
or
.
We must not include any extra text outside HTML.
Let's craft.
Structure:
About the role
Job summary paragraph.
Responsibilities
- Lead the end-to-end A&A and ATO process for federal information systems.
- Manage and mentor a team of five to eight Security Control Assessors and ISSOs.
- Develop and maintain integrated ATO schedules, milestones, priorities, and resource assignments.
- Coordinate security authorization activities with system owners, technical teams, ISSOs, assessors, authorizing officials, and other stakeholders.
- Apply the NIST Risk Management Framework throughout the system development and authorization lifecycle.
- Review and validate security authorization documentation, including:
- System Security Plans
- Security Assessment Plans
- Security Assessment Reports
- Plans of Action and Milestones
- Risk assessments
- Contingency plans
- Continuous monitoring plans
- Security control implementation evidence
- Oversee security control assessments and ensure findings are clearly documented, supported by evidence, and assigned appropriate risk ratings.
- Evaluate system vulnerabilities, control deficiencies, and residual risks to support authorization decisions.
- Monitor remediation activities and ensure POA&M items are properly documented, tracked, updated, and closed.
- Conduct quality assurance reviews of A&A packages before submission to the Authorizing Official.
- Identify risks, schedule delays, documentation gaps, and resource constraints and communicate them to program leadership.
- Establish standardized A&A procedures, templates, checklists, and quality-control processes.
- Facilitate status meetings, risk-review sessions, and authorization-readiness reviews.
- Support continuous monitoring, annual assessments, significant-change reviews, and authorization renewals.
- Prepare executive-level dashboards, metrics, and reports describing ATO status, risks, findings, and remediation progress.
- Provide guidance to system teams on federal cybersecurity policies, control implementation, and compliance expectations.
- Promote accountability, collaboration, and consistent performance across the A&A team.
Requirements
- Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline.
- Minimum 8 years of cybersecurity, information assurance, or information system security experience.
- Minimum 5 years of experience supporting federal A&A, ATO, or NIST RMF activities.
- Minimum 5 years of experience managing or leading teams of Security Control Assessors, ISSOs, or cybersecurity analysts.
- Minimum 5 years of experience to include:
- NIST Risk Management Framework
- NIST SP 800-37
- NIST SP 800-53
- NIST SP 800-53A
- NIST SP 800-30
- FISMA requirements
- Federal continuous monitoring practices
- Minimum 5 years of experience reviewing complex security authorization packages and evaluating security control evidence
Requirements
orQualifications
. The instruction includes both Requirements and Qualifications as possible headings. We need to decide. Probably combine basic qualifications under Requirements, and preferred under Qualifications? Or we could have Requirements for basic qualifications, Qualifications for preferred. Let's do that. Skills: maybe we can extract from preferred qualifications: leadership, analytical, etc. Could be under Skills. Benefits: described. Pay: given. Schedule: not mentioned, so omit. We must not repeat job title as heading. No Job ID. We must remove boilerplate: EEO, legal, etc. We must preserve all substantive information. Let's extract content. Job Summary paragraph: "NTT DATA is seeking an experienced Assessment and Authorization (A&A) Lead to oversee cybersecurity assessment, authorization, and continuous monitoring activities for federal information systems. The successful candidate will possess strong knowledge of the NIST Risk Management Framework (RMF), federal security requirements, and the complete Authorization to Operate (ATO) lifecycle. This position will lead and manage a team of approximately five to eight Security Control Assessors, Information System Security Officers (ISSOs), and other cybersecurity professionals. The A&A Lead will be responsible for ensuring that security authorization packages are accurate, complete, compliant, and delivered according to established schedules. The A&A Lead must be a hands-on leader who can establish priorities, assign responsibilities, remove obstacles, coach team members, and maintain high-quality deliverables. The individual must be comfortable engaging directly with senior government stakeholders, presenting authorization risks, and recommending practical solutions that balance mission requirements with cybersecurity compliance." That's the summary. Responsibilities: list from "Job Duties:" bullet points. Let's extract each duty: - Lead the end-to-end A&A and ATO process for federal information systems. - Manage and mentor a team of five to eight Security Control Assessors and ISSOs. - Develop and maintain integrated ATO schedules, milestones, priorities, and resource assignments. - Coordinate security authorization activities with system owners, technical teams, ISSOs, assessors, authorizing officials, and other stakeholders. - Apply the NIST Risk Management Framework throughout the system development and authorization lifecycle. - Review and validate security authorization documentation, including: System Security Plans Security Assessment Plans Security Assessment Reports Plans of Action and Milestones Risk assessments Contingency plans Continuous monitoring plans Security control implementation evidence - Oversee security control assessments and ensure findings are clearly documented, supported by evidence, and assigned appropriate risk ratings. - Evaluate system vulnerabilities, control deficiencies, and residual risks to support authorization decisions. - Monitor remediation activities and ensure POA&M items are properly documented, tracked, updated, and closed. - Conduct quality assurance reviews of A&A packages before submission to the Authorizing Official. - Identify risks, schedule delays, documentation gaps, and resource constraints and communicate them to program leadership. - Establish standardized A&A procedures, templates, checklists, and quality-control processes. - Facilitate status meetings, risk-review sessions, and authorization-readiness reviews. - Support continuous monitoring, annual assessments, significant-change reviews, and authorization renewals. - Prepare executive-level dashboards, metrics, and reports describing ATO status, risks, findings, and remediation progress. - Provide guidance to system teams on federal cybersecurity policies, control implementation, and compliance expectations. - Promote accountability, collaboration, and consistent performance across the A&A team. We need to format as- . For the nested list under "Review and validate security authorization documentation, including:" we could either make a sublist or just include as part of the li text. Probably better to keep as part of li text with commas or semicolons. But we could also make a sublist. The instruction didn't forbid sublists. Use
- for any list of duties/requirements/benefits. So we can have a top-level ul for duties, and inside a duty we can have another ul for the subitems. That's fine.
Requirements (basic qualifications): list:
- Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline.
- Minimum 8 years of cybersecurity, information assurance, or information system security experience.
- Minimum 5 years of experience supporting federal A&A, ATO, or NIST RMF activities.
- Minimum 5 years of experience managing or leading teams of Security Control Assessors, ISSOs, or cybersecurity analysts.
- Minimum 5 years of experience to include:
NIST Risk Management Framework
NIST SP 800-37
NIST SP 800-53
NIST SP 800-53A
NIST SP 800-30
FISMA requirements
Federal continuous monitoring practices
- Minimum 5 years of experience reviewing complex security authorization packages and evaluating security control evidence.
- Minimum 5 years of experience of security risk management, vulnerability management, POA&M management, and continuous monitoring.
- Candidates must hold at least one of the following active certifications:
Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
We could format as ul.
Qualifications (preferred): list:
- Experience supporting cybersecurity programs within NIH, HHS, or another federal civilian agency.
- Experience with federal governance, risk, and compliance platforms such as CSAM, JCAM, ServiceNow GRC, or similar tools.
- Experience managing a portfolio of systems with concurrent ATO deadlines.
- Familiarity with cloud security requirements, including FedRAMP and NIST controls for AWS, Microsoft Azure, or other cloud environments.
- Experience developing A&A standard operating procedures, playbooks, templates, and performance metrics.
- Additional certifications such as CAP/CGRC, CRISC, CCSP, PMP, or Security+.
- Experience supporting high-impact or mission-critical federal information systems.
- Strong leadership, analytical, organizational, and problem-solving skills.
- Excellent written and verbal communication skills, including the ability to communicate technical risks to executive and nontechnical stakeholders.
- Ability to work effectively with government leadership, system owners, engineers, cybersecurity teams, and third-party assessors.
We could split skills: leadership etc. But we can keep under Qualifications.
Skills: maybe we can extract leadership etc. But we already have them in Qualifications. Could create a Skills section for those soft skills. However instruction says prefer few substantive sections over many thin ones. So maybe we combine preferred qualifications and skills into Qualifications. Or we could have Qualifications for hard requirements and Skills for soft skills. Let's decide: We'll have Requirements (basic qualifications) and Qualifications (preferred + skills). That seems reasonable.
Benefits: list:
- medical, dental, and vision insurance with an employer contribution
- flexible spending or health savings account
- life and AD&D insurance
- short and long term disability coverage
- paid time off
- employee assistance
- participation in a 401k program with company match
- additional voluntary or legally-required benefits
Pay: starting pay range $110,179 - $183,631. Also mention incentive compensation eligibility.
We need to include that actual compensation depends on factors, incentive compensation based on performance, if temporary not eligible. We'll include as prose under Pay.
Schedule: not present, omit.
Now produce HTML fragment with
headings and appropriate
or
- .
We must not include any extra text outside HTML.
Let's craft.
Structure:
- Lead the end-to-end A&A and ATO process for federal information systems.
- Manage and mentor a team of five to eight Security Control Assessors and ISSOs.
- Develop and maintain integrated ATO schedules, milestones, priorities, and resource assignments.
- Coordinate security authorization activities with system owners, technical teams, ISSOs, assessors, authorizing officials, and other stakeholders.
- Apply the NIST Risk Management Framework throughout the system development and authorization lifecycle.
- Review and validate security authorization documentation, including:
- System Security Plans
- Security Assessment Plans
- Security Assessment Reports
- Plans of Action and Milestones
- Risk assessments
- Contingency plans
- Continuous monitoring plans
- Security control implementation evidence
- Oversee security control assessments and ensure findings are clearly documented, supported by evidence, and assigned appropriate risk ratings.
- Evaluate system vulnerabilities, control deficiencies, and residual risks to support authorization decisions.
- Monitor remediation activities and ensure POA&M items are properly documented, tracked, updated, and closed.
- Conduct quality assurance reviews of A&A packages before submission to the Authorizing Official.
- Identify risks, schedule delays, documentation gaps, and resource constraints and communicate them to program leadership.
- Establish standardized A&A procedures, templates, checklists, and quality-control processes.
- Facilitate status meetings, risk-review sessions, and authorization-readiness reviews.
- Support continuous monitoring, annual assessments, significant-change reviews, and authorization renewals.
- Prepare executive-level dashboards, metrics, and reports describing ATO status, risks, findings, and remediation progress.
- Provide guidance to system teams on federal cybersecurity policies, control implementation, and compliance expectations.
- Promote accountability, collaboration, and consistent performance across the A&A team.
- Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline.
- Minimum 8 years of cybersecurity, information assurance, or information system security experience.
- Minimum 5 years of experience supporting federal A&A, ATO, or NIST RMF activities.
- Minimum 5 years of experience managing or leading teams of Security Control Assessors, ISSOs, or cybersecurity analysts.
- Minimum 5 years of experience to include:
- NIST Risk Management Framework
- NIST SP 800-37
- NIST SP 800-53
- NIST SP 800-53A
- NIST SP 800-30
- FISMA requirements
- Federal continuous monitoring practices
- Minimum 5 years of experience reviewing complex security authorization packages and evaluating security control evidence
About the role
Job summary paragraph.
Responsibilities
Requirements
- for any list of duties/requirements/benefits. So we can have a top-level ul for duties, and inside a duty we can have another ul for the subitems. That's fine.
Requirements (basic qualifications): list:
- Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline.
- Minimum 8 years of cybersecurity, information assurance, or information system security experience.
- Minimum 5 years of experience supporting federal A&A, ATO, or NIST RMF activities.
- Minimum 5 years of experience managing or leading teams of Security Control Assessors, ISSOs, or cybersecurity analysts.
- Minimum 5 years of experience to include:
NIST Risk Management Framework
NIST SP 800-37
NIST SP 800-53
NIST SP 800-53A
NIST SP 800-30
FISMA requirements
Federal continuous monitoring practices
- Minimum 5 years of experience reviewing complex security authorization packages and evaluating security control evidence.
- Minimum 5 years of experience of security risk management, vulnerability management, POA&M management, and continuous monitoring.
- Candidates must hold at least one of the following active certifications:
Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
We could format as ul.
Qualifications (preferred): list:
- Experience supporting cybersecurity programs within NIH, HHS, or another federal civilian agency.
- Experience with federal governance, risk, and compliance platforms such as CSAM, JCAM, ServiceNow GRC, or similar tools.
- Experience managing a portfolio of systems with concurrent ATO deadlines.
- Familiarity with cloud security requirements, including FedRAMP and NIST controls for AWS, Microsoft Azure, or other cloud environments.
- Experience developing A&A standard operating procedures, playbooks, templates, and performance metrics.
- Additional certifications such as CAP/CGRC, CRISC, CCSP, PMP, or Security+.
- Experience supporting high-impact or mission-critical federal information systems.
- Strong leadership, analytical, organizational, and problem-solving skills.
- Excellent written and verbal communication skills, including the ability to communicate technical risks to executive and nontechnical stakeholders.
- Ability to work effectively with government leadership, system owners, engineers, cybersecurity teams, and third-party assessors.
We could split skills: leadership etc. But we can keep under Qualifications.
Skills: maybe we can extract leadership etc. But we already have them in Qualifications. Could create a Skills section for those soft skills. However instruction says prefer few substantive sections over many thin ones. So maybe we combine preferred qualifications and skills into Qualifications. Or we could have Qualifications for hard requirements and Skills for soft skills. Let's decide: We'll have Requirements (basic qualifications) and Qualifications (preferred + skills). That seems reasonable.
Benefits: list:
- medical, dental, and vision insurance with an employer contribution
- flexible spending or health savings account
- life and AD&D insurance
- short and long term disability coverage
- paid time off
- employee assistance
- participation in a 401k program with company match
- additional voluntary or legally-required benefits
Pay: starting pay range $110,179 - $183,631. Also mention incentive compensation eligibility.
We need to include that actual compensation depends on factors, incentive compensation based on performance, if temporary not eligible. We'll include as prose under Pay.
Schedule: not present, omit.
Now produce HTML fragment with