Senior RMF Security Analyst
Assurit · Fairfax, VA · 1 mo ago
Full-time
We need to output HTML fragment with sections: About the role, Responsibilities, Required Qualifications, Preferred Qualifications, maybe Benefits? The posting mentions "We offer a highly competitive compensation and benefits package inclusive of medical and dental coverage, as well as paid time off." That's benefits info. Also location hybrid (Beltsville, Maryland) is in About the role? Actually location appears after job title: "Hybrid (Beltsville, Maryland)". Should we include location? The instruction: "Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short for section headings. Use
or drop it." So location is minor metadata; we can include in a short
maybe under About the role or separate? Probably include in About the role paragraph. We must not create Pay/Schedule/Benefits sections unless posting actually states them. It does state benefits: "highly competitive compensation and benefits package inclusive of medical and dental coverage, as well as paid time off." That's benefits. So we can create a Benefits section with that content. We must not create sections with filler like "commensurate with experience". Not present. We need to use
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive information. Remove boilerplate like navigation, EEO, etc. Also remove duplicated lines.
We need to include About the role, Responsibilities, Required Qualifications, Preferred Qualifications, Benefits. Possibly also "About Assurit"? The posting includes "Working at Assurit" paragraph about company. That's substantive but maybe not required? It's about the company; we could include as "About Assurit" but not a standard heading; but we could include as a paragraph under maybe "About Assurit". However instruction: "Prefer a few substantive sections over many thin ones." Could combine company info into About the role? But better to have a section "About Assurit". However the standard headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. They didn't list About the company. But we can still include if there is real content. The instruction: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not exclusive. So we can add other headings if needed. But they said "Prefer a few substantive sections over many thin ones." So maybe we keep to those standard headings and incorporate company info into About the role or Benefits? Probably include a brief paragraph about Assurit in About the role? But About the role already has description. Could add another paragraph after that about company.
Let's extract substantive content:
Job title: Assurit Cybersecurity Senior RMF Security Analyst Hybrid (Beltsville, Maryland) - we don't repeat as heading.
About The Role paragraph: "Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems."
Location: Hybrid (Beltsville, Maryland) - we can include as a short p.
Responsibilities: bullet list under RMF Step 1, Step 2, Step 3. Each step has multiple bullet points. We need to preserve all. Use - for each duty. Could group by step with subheadings? Not required but could keep as plain list. However we need to preserve the structure maybe. Could create subheadings
? Not allowed? Only h3 for section headings. Could use inside li? Probably fine to just list all responsibilities as li.
Let's list them:
RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
Note: The first bullet of Step 3 says "Review Finalize System Security Plan compliance descriptions." Might be a typo but we keep as is.
Required Qualifications: list:
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
- NIST SP 800-37 Rev. 2
- NIST SP 800-171 Rev. 2
- NIST SP 800-47 Rev. 1
- Other publications and guidance related to the federal RMF process
We need to preserve the nested list? Could flatten.
Preferred Qualifications:
- Prior federal civilian-agency A&A experience.
- Prior USDA cybersecurity or RMF experience is a plus.
- Experience with the USDA Six-Step RMF Process or USDA CSAM instance is a strong plus.
- Experience independently supporting RMF activities across multiple federal information systems.
- Active certification such as CISSP, CGRC (formerly CAP), or CISM.
- Current or prior federal Public Trust investigation.
Benefits: "We offer a highly competitive compensation and benefits package inclusive of medical and dental coverage, as well as paid time off."
Also maybe mention "Founded in 2013, Assurit has become a trusted provider..." That's from Working at Assurit paragraph. Could include as About Assurit section.
But we might incorporate that into About the role? Might be better to have a separate "About Assurit" section.
Let's decide: We'll have sections: About the role, Responsibilities, Required Qualifications, Preferred Qualifications, Benefits, About Assurit.
Now produce HTML fragment.
We need to wrap each section in heading then content.
For lists, use - .
For prose, use
.
We need to include location maybe as a p under About the role.
Let's craft.
About the role:
About the role
Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems.
Location: Hybrid (Beltsville, Maryland)
But we used which is okay.
Responsibilities:
Responsibilities
- RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
- RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
- RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
But we have nested lists; still okay.
Required Qualifications:
Required Qualifications
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
for prose. We need to preserve all substantive information. Remove boilerplate like navigation, EEO, etc. Also remove duplicated lines. We need to include About the role, Responsibilities, Required Qualifications, Preferred Qualifications, Benefits. Possibly also "About Assurit"? The posting includes "Working at Assurit" paragraph about company. That's substantive but maybe not required? It's about the company; we could include as "About Assurit" but not a standard heading; but we could include as a paragraph under maybe "About Assurit". However instruction: "Prefer a few substantive sections over many thin ones." Could combine company info into About the role? But better to have a section "About Assurit". However the standard headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. They didn't list About the company. But we can still include if there is real content. The instruction: "use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., not exclusive. So we can add other headings if needed. But they said "Prefer a few substantive sections over many thin ones." So maybe we keep to those standard headings and incorporate company info into About the role or Benefits? Probably include a brief paragraph about Assurit in About the role? But About the role already has description. Could add another paragraph after that about company.
Let's extract substantive content:
Job title: Assurit Cybersecurity Senior RMF Security Analyst Hybrid (Beltsville, Maryland) - we don't repeat as heading.
About The Role paragraph: "Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems."
Location: Hybrid (Beltsville, Maryland) - we can include as a short p.
Responsibilities: bullet list under RMF Step 1, Step 2, Step 3. Each step has multiple bullet points. We need to preserve all. Use - for each duty. Could group by step with subheadings? Not required but could keep as plain list. However we need to preserve the structure maybe. Could create subheadings
? Not allowed? Only h3 for section headings. Could use inside li? Probably fine to just list all responsibilities as li.
Let's list them:
RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
Note: The first bullet of Step 3 says "Review Finalize System Security Plan compliance descriptions." Might be a typo but we keep as is.
Required Qualifications: list:
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
- NIST SP 800-37 Rev. 2
- NIST SP 800-171 Rev. 2
- NIST SP 800-47 Rev. 1
- Other publications and guidance related to the federal RMF process
We need to preserve the nested list? Could flatten.
Preferred Qualifications:
- Prior federal civilian-agency A&A experience.
- Prior USDA cybersecurity or RMF experience is a plus.
- Experience with the USDA Six-Step RMF Process or USDA CSAM instance is a strong plus.
- Experience independently supporting RMF activities across multiple federal information systems.
- Active certification such as CISSP, CGRC (formerly CAP), or CISM.
- Current or prior federal Public Trust investigation.
Benefits: "We offer a highly competitive compensation and benefits package inclusive of medical and dental coverage, as well as paid time off."
Also maybe mention "Founded in 2013, Assurit has become a trusted provider..." That's from Working at Assurit paragraph. Could include as About Assurit section.
But we might incorporate that into About the role? Might be better to have a separate "About Assurit" section.
Let's decide: We'll have sections: About the role, Responsibilities, Required Qualifications, Preferred Qualifications, Benefits, About Assurit.
Now produce HTML fragment.
We need to wrap each section in heading then content.
For lists, use - .
For prose, use
.
We need to include location maybe as a p under About the role.
Let's craft.
About the role:
About the role
Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems.
Location: Hybrid (Beltsville, Maryland)
But we used which is okay.
Responsibilities:
Responsibilities
- RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
- RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
- RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
But we have nested lists; still okay.
Required Qualifications:
Required Qualifications
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
? Not allowed? Only h3 for section headings. Could use inside li? Probably fine to just list all responsibilities as li.
Let's list them:
RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
Note: The first bullet of Step 3 says "Review Finalize System Security Plan compliance descriptions." Might be a typo but we keep as is.
Required Qualifications: list:
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
- NIST SP 800-37 Rev. 2
- NIST SP 800-171 Rev. 2
- NIST SP 800-47 Rev. 1
- Other publications and guidance related to the federal RMF process
We need to preserve the nested list? Could flatten.
Preferred Qualifications:
- Prior federal civilian-agency A&A experience.
- Prior USDA cybersecurity or RMF experience is a plus.
- Experience with the USDA Six-Step RMF Process or USDA CSAM instance is a strong plus.
- Experience independently supporting RMF activities across multiple federal information systems.
- Active certification such as CISSP, CGRC (formerly CAP), or CISM.
- Current or prior federal Public Trust investigation.
Benefits: "We offer a highly competitive compensation and benefits package inclusive of medical and dental coverage, as well as paid time off."
Also maybe mention "Founded in 2013, Assurit has become a trusted provider..." That's from Working at Assurit paragraph. Could include as About Assurit section.
But we might incorporate that into About the role? Might be better to have a separate "About Assurit" section.
Let's decide: We'll have sections: About the role, Responsibilities, Required Qualifications, Preferred Qualifications, Benefits, About Assurit.
Now produce HTML fragment.
We need to wrap each section in heading then content.
For lists, use - .
For prose, use
.
We need to include location maybe as a p under About the role.
Let's craft.
About the role:
About the role
Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems.
Location: Hybrid (Beltsville, Maryland)
But we used which is okay.
Responsibilities:
Responsibilities
- RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
- RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
- RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
But we have nested lists; still okay.
Required Qualifications:
Required Qualifications
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
- .
For prose, use
. We need to include location maybe as a p under About the role. Let's craft. About the role:
About the role
Assurit is seeking a senior, hands-on RMF Security Analyst to support federal information systems through RMF Steps 1–3. The analyst will work closely with government cybersecurity stakeholders to develop and maintain the security documentation required to achieve, maintain, and renew system Authorities to Operate (ATOs). The ideal candidate will have extensive federal A&A experience and the ability to independently develop high-quality RMF documentation across multiple information systems.
Location: Hybrid (Beltsville, Maryland)
But we used which is okay. Responsibilities:Responsibilities
- RMF Step 1 – Categorize the System
- Collect and update general system information.
- Create and maintain system records in CSAM, including system identification information, system descriptions, and technical narratives.
- Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs).
- Perform and update FIPS 199 security categorizations.
- Perform and update E-Authentication Risk Assessments.
- RMF Step 2 – Select Security Controls
- Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
- Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
- Develop compensating controls when required.
- Develop and update Contingency Plans and related testing and training documentation.
- Develop and update System of Records Notices, Configuration Management Plans, Incident Response Plans, Business Impact Assessments, and Interconnection Security Agreements.
- RMF Step 3 – Implement and Support
- Review Finalize System Security Plan compliance descriptions.
- Finalize Contingency Plans, Configuration Management Plans, Incident Response Plans, and Disaster Recovery Plans, as required.
- Assist government stakeholders in addressing findings and updating documentation during concurrence and authorization reviews.
- Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.
Required Qualifications
- U.S. citizenship.
- Bachelor’s degree and at least eight years of relevant cybersecurity experience.
- Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
- Hands-on experience developing and maintaining federal A&A and authorization packages.
- Hands-on experience using the Cybersecurity Assessment and Management System (CSAM).
- Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
- Experience developing SSPs, contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
- Strong technical-writing skills and the ability to produce accurate, complete, and Section 508-compliant documentation.
- Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
- Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential.
- Working knowledge of:
- NIST Risk Management Framework
- FIPS PUB 199
- NIST SP 800-53 Rev. 4 and/or Rev. 5
- RMF Step 1 – Categorize the System