RMF/ISSO Analyst

This is a fully remote position, open to applicants in Illinois.

📋 Description

• Manage the authorization packages and associated documentation for the Risk Management Framework throughout the system authorization lifecycle.

• Create and sustain security-control implementation statements, control evidence, system security documentation, and records for continuous monitoring.

• Oversee system-level Plans of Action and Milestones, which include findings, remediation actions, milestones, responsible parties, supporting evidence, and closure status.

• Develop, review, and maintain system interconnection agreements along with related authorization documentation.

• Assist in ensuring compliance with the USMEPCOM Tenant Security Plan for the organization's segment of the DoD Information Network Non-classified Internet Protocol Router Network.

• Aid in the development, review, submission, maintenance, and renewal of Authority to Operate and Authority to Connect packages.

• Examine authorization packages for accuracy, completeness, consistency, and traceability prior to submission to the Government or assessors.

• Assess security-control implementation and evidence against relevant NIST SP 800-53, DoD, Army, and USMEPCOM requirements.

• Support security-control testing for USMEPCOM systems, applications, networks, and their supporting infrastructure.

• Conduct internal readiness reviews for authorization and perform necessary checks and tests as per the DoD Risk Management Framework.

• Create Security Test and Evaluation test plans that address applicable NIST, DoD, Army, and USMEPCOM information-system security testing requirements.

• Assist in preparing at least two Security Test and Evaluation test plans and the associated testing activities during the contract period.

• Gather, organize, validate, and upload authorization evidence into eMASS or the Government-designated repository.

• Ensure traceability among security controls, implementation statements, test results, vulnerabilities, remediation activities, and authorization decisions.

• Analyze comments from assessors and coordinate responses with system owners, engineers, administrators, developers, and Government cybersecurity personnel.

• Address documentation deficiencies and ensure that assessor comments are resolved with accurate explanations and appropriate supporting evidence.

• Monitor authorization conditions, open findings, expiring artifacts, and ongoing continuous-monitoring requirements.

• Support security-status reporting, risk summaries, authorization schedules, and cybersecurity briefings for Government and program leadership.

• Identify authorization risks, evidence gaps, and potential schedule impacts, recommending practical corrective actions.

• Safeguard sensitive cybersecurity documentation and ensure that records are managed in accordance with applicable Government regulations.

⛳️ Requirements

• Active Secret clearance or higher is mandatory.

• Bachelor’s degree in Cybersecurity, Information Systems, or a related discipline.

• A minimum of 10 years of relevant experience in cybersecurity, information assurance, RMF, or information-system security.

• Current CompTIA Security+ certification is required.

• Experience in supporting the Department of Defense Risk Management Framework.

• Proficiency with eMASS or the Government-designated authorization repository.

• Experience fulfilling Information System Security Officer responsibilities in a federal or DoD environment.

• Experience providing support to Government ISSMs, system owners, Security Control Assessors, Authorizing Officials, or Common Control Providers.

• Familiarity with DoDI 8510.01, NIST SP 800-37, NIST SP 800-53, FISMA, and relevant DoD cybersecurity policies.

• Experience in developing or maintaining system security plans, control implementation statements, interconnection agreements, continuous-monitoring strategies, and authorization decision documentation.

• Experience supporting ATO, ATC, reaccreditation, and ongoing authorization processes.

• Experience in developing and executing Security Test and Evaluation plans.

• Experience in conducting security-control assessments, control validation, evidence reviews, and readiness reviews for authorization.

• Experience managing system-level POA&Ms and coordinating technical remediation efforts.

• Familiarity with ACAS or Tenable, STIG Viewer, SCAP tools, Endpoint Security Solutions, or similar DoD cybersecurity technologies.

• Experience maintaining traceable evidence repositories and addressing assessor or audit comments.

• Strong capabilities in technical writing, documentation management, analysis, and stakeholder coordination.

• Ability to articulate technical security-control deficiencies and authorization risks to both technical and non-technical stakeholders.

🏝️ Benefits

• Active Secret clearance or higher is required for the position.

• Regular full-time employment.