Senior RMF Policy Analyst

About the role

KBR is seeking a highly skilled Senior RMF Policy Analyst to support cybersecurity governance, Risk Management Framework (RMF) compliance, and Assessment & Authorization (A&A) efforts within a complex Department of Defense (DoD) environment. The successful candidate will serve as a trusted cybersecurity subject matter expert responsible for developing, maintaining, and enhancing RMF policies, standard operating procedures (SOPs), training materials, and documentation that support mission-critical systems and applications. This role requires extensive knowledge of DoD cybersecurity requirements, eMASS, NIST guidance, and DHA authorization processes, along with the ability to collaborate across technical and program teams to improve compliance, automate workflows, and ensure adherence to evolving cybersecurity standards. The ideal candidate is a self-driven professional with strong analytical, communication, and leadership skills who can effectively manage multiple priorities while serving as a key advisor on RMF policy, cybersecurity documentation, training, and process improvement initiatives.

Responsibilities

• Review, analyze, and update existing A&A Process SOPs to reflect current Government-approved practices.
• Review and update, where and when needed, the existing certification/testing model so it reflects best business practices in information technology/security once approved by the Government.
• Review current processes and recommend/develop automated processes in the areas of application risk assessments and additionally update/map these processes to existing interactive workflows and processes in SharePoint.
• Function as the primary Point of Contact with responsibility for the development and maintenance of the cybersecurity SOPs.
• Provide subject matter expertise in the area of DoD and DHA A&A requirements.
• Ensure accuracy of the information introduced in the SOPs and institute and exercise proper change control mechanisms when proposing or making changes to the technical, functional, or contextual information contained in the SOPs.
• Ensure the accuracy and correctness of the procedures and processes in the SOPs by utilizing a thorough Quality Assurance (QA) plan.
• Maintain all RMF/DIACAP documentation templates associated with A&A efforts and associated deliverables.
• Create, maintain, and manage training materials for approval by the Government.
• Apprise users about available assistance as well as technical security products and techniques. Varying levels of security training are required depending on a person's roles and responsibilities.
• Attend weekly CCB/SCAR Tiger Team meetings and monthly ACAS/CMRS meetings to understand issues and changes which drive potential updates to training content.
• Understand how eMASS functions and provide responses to technical and cyber-related questions.

Requirements

• Bachelor's degree in Engineering, Physics, Network Security, Computer Science, or related field. In lieu of a degree, 15 years of relevant experience may be considered.
• Ten (10) years of experience in Engineering, Systems Analysis, Medical Systems, Cybersecurity, Web Development, or Engineering Management.
• Five (5) years of technical experience supporting cybersecurity, network protection, or virtualization projects.
• Demonstrated experience with RMF Steps 1-5.
• Working knowledge of eMASS (Enterprise Mission Assurance Support Service).
• Knowledge of NIST SP 800-53, NIST SP 800-37, CNSSI 1254, and applicable DoD Risk Management policies.
• Experience developing RMF cybersecurity documentation.
• Familiarity with vulnerability scanning and assessment tools used to identify, assess, and document compliance.
• Ability to lead teams and effectively interact with senior-level program personnel and government stakeholders.
• Ability to manage multiple priorities and projects simultaneously.
• Strong written, verbal, and customer service communication skills.
• Self-starter with the ability to work independently while collaborating in a dynamic team environment.
• Active Secret clearance required.
• Current CompTIA Security+ certification or DoD 8570 IAT/IAM Level I (or higher) certification required.

Preferred Qualifications

• Experience supporting the Defense Health Agency (DHA) Cyber Security Directorate.
• Experience developing, maintaining, or updating cybersecurity policies, SOPs, and training materials.
• Experience conducting cybersecurity training in virtual and/or classroom environments.
• Experience supporting Assessment & Authorization (A&A) efforts for DoD systems.
• Experience with SharePoint workflow development, process automation, and application risk assessment processes.
• Familiarity with RMF/DIACAP documentation templates and A&A deliverables.
• Advanced degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related technical field.

Benefits

• 401K plan with company match
• Medical, dental, vision
• Life insurance, AD&D
• Flexible spending account
• Disability
• Paid time off
• Flexible work schedule
• Professional training and development

Pay

Compensation: $115,000-140,000. The salary range posted is based on the national average. The offered rate will be based on the selected candidate’s location, knowledge, skills, abilities, and/or experience, contract affordability, and in consideration of internal parity. Additional compensation may include bonuses, commissions, sign-on bonuses, relocation benefits, short-term incentives, long-term incentives, or