Cyber RMF Specialist

About the role

SHR Consulting Group is a premier technology integrator addressing complex modernization and readiness challenges across defense, federal civilian, and intelligence markets. We offer a wide range of services including systems engineering and integration, enterprise IT, cyber, software, and advanced analytics and AI.

Responsibilities

• Execute RMF activities in accordance with DoD Instruction 8510.01 across the six RMF steps: Categorize, Select, Implement, Assess, Authorize, and Monitor.
• Develop, review, and maintain System Security Plans (SSPs), Risk Assessment Reports (RARs), Security Assessment Reports (SARs), and supporting Assessment and Authorization (A&A) artifacts.
• Support ATO sustainment, reauthorization, and ongoing authorization activities for assigned accreditation boundaries.
• eMASS Administration: Administer the Enterprise Mission Assurance Support Service (eMASS) including system registration, control implementation status updates, artifact uploads, and workflow routing to the assessor and Authorizing Official.
• Continuous Monitoring: Execute continuous monitoring activities including control reassessment, configuration drift analysis, and recurring evidence collection to maintain authorization currency.
• Control Mapping: Maintain accurate mappings between deployed technical controls, NIST SP 800-53 control statements, and DoD overlays so that compliance evidence is traceable end-to-end.
• POA&M and Vulnerability Management: Develop, track, and update Plan of Action and Milestones (POA&Ms) on the cadence required by Government leadership; conduct root cause analysis for repeat findings and recommend systemic controls to drive down the vulnerability backlog.
• STIG, IAVM, and Cyber Hygiene: Conduct STIG compliance assessments using SCAP-based tools, STIG Viewer, and manual checks against deployed systems; analyze ACAS / Nessus vulnerability scan output, develop weekly scan analysis reports, and coordinate remediation with system owners.
• Cyber Tasking and Deployment Compliance: Acknowledge receipt of TASKORDs, OPORDs, and other Government cyber tasking within the required response window; decompose Government cyber tasking into actionable work, assign to responsible parties, and track to closure with auditable evidence.
• Cybersecurity and Compliance Coordination: Ensure all assigned systems maintain compliance with DoD Security Technical Implementation Guides (STIGs), Information Assurance Vulnerability Alerts (IAVAs), and applicable Command Cyber Tasking Orders (CCTOs); support cybersecurity incident response activities including evidence collection, timeline reconstruction, and after-action reporting.
• Documentation and Communication: Develop, update, and maintain SOPs, Work Instructions (WIs), and technical documentation for all supported compliance functions; provide status updates, incident reports, and After Action Reports (AARs) as required by Government leadership.

Requirements

• Working knowledge of the DoD Risk Management Framework (RMF) and NIST SP 800-53, NIST SP 800-37, and CNSSI 1253.
• Experience developing or maintaining A&A documentation (SSP, RAR, SAR, POA&M).
• Experience with eMASS or an equivalent A&A workflow tool.
• Working knowledge of DoD STIGs, IAVAs, SCAP, and STIG Viewer.
• Experience analyzing ACAS / Nessus vulnerability scan results.
• Familiarity with Windows Server, Active Directory, and common DoD IT infrastructure.
• Ability to apply DoD STIGs and IAVAs to maintain system compliance.
• Ability to create and maintain technical documentation, SOPs, and compliance artifacts.
• Ability to work shift hours, weekends, or on-call rotations as required by task order.
• Strong oral and written communication skills; ability to brief technical topics to non-technical stakeholders.

Qualifications

• One of the following is required:
• Bachelor's degree in Computer Science, Computer Engineering, Information Technology, Information Systems, Cybersecurity, or a closely related technical field;
• Associate's degree in a related technical field plus additional qualifying experience;
• Equivalent combination of education, training, and directly relevant DoD IT experience as defined by labor category level below:
• Junior (0-2 years): Works under supervision; executes defined tasks; learns SOPs and tools;
• Mid (3-5 years): Works independently on most tasks; supports complex troubleshooting; mentors juniors;
• Senior (6+ years): SME-level expertise; leads technical efforts; guides architecture and compliance decisions.

Pay

Competitive salary based on experience.

Schedule

Work is performed in a Government facility or contractor site supporting classified and/or unclassified IT environments. Personnel may be required to work in data centers or consolidated server rooms with associated environmental conditions (temperature, noise, physical equipment). Occasional lifting of IT equipment up to 50 lbs may be required. Personnel may be required to support 24x7 operations via scheduled shifts or on-call arrangements. Travel to alternate Government sites may be required on an as-needed basis.

Benefits

• Comprehensive benefits package including health, dental, vision, and retirement plans.
• Paid time off and holidays.