Risk Management Framework (RMF) Support/Senior

The application deadline and start date are subject to change based on the status of the contract.  Applications will be accepted through expiration date or until the position is filled.  If the contract is not awarded, this position may not be filled.

Koniag IT Systems, LLC, a Koniag Government Services company, is seeking a Risk Management Framework (RMF) Support/Senior with a Secret security clearance to support KITS and our government customer in Smyrna, GA. This position is for a Future New Business Opportunity.   

Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits and tuition reimbursement.

Koniag IT Systems, a Koniag Government Services company, is seeking an experienced Risk Management Framework (RMF) Support/Senior professional to serve as the RMF Lead supporting our government customer. The ideal candidate is a seasoned cybersecurity professional with deep expertise in the RMF process, security control assessments, and risk management within federal government environments. The successful candidate will perform dual functions as both a Team Lead and Senior Functional Expert, serving as the single point of contact for government stakeholders on all RMF-related activities. An active ADP-II/Secret clearance is required for this position. 

The RMF Support/Senior will serve as the RMF Lead, integrating security and risk management activities into the system development life cycle while applying a risk-based approach to security control selection and specification.

Principal responsibilities will include but are not limited to:

• Serve as the RMF Lead and primary single point of contact for the Government Task Monitor (GTM) and the Assessment & Authorization (A&A) government lead.
• Perform dual functions as Team Lead and Senior Functional Expert, providing guidance, oversight, and expertise to team members supporting RMF activities.
• Conduct and oversee all activities that integrate security and risk management into the system development life cycle (SDLC), ensuring alignment with applicable laws, directives, Executive Orders, policies, standards, and regulations.
• Apply a risk-based approach to security control selection and specification, considering effectiveness, efficiency, and applicable constraints.
• Lead and perform security control assessments and residual risk determinations across all steps of the RMF process.
• Oversee the preparation, review, and maintenance of A&A documentation packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and Risk Assessment Reports.
• Coordinate with system owners, information system security officers (ISSOs), and other stakeholders to ensure continuous monitoring and compliance with security requirements.
• Provide expert guidance on RMF process steps including Categorize, Select, Implement, Assess, Authorize, and Monitor.
• Identify and communicate security risks, recommend mitigation strategies, and support the development of risk acceptance decisions.
• Ensure compliance with most current DoW guidance and other applicable federal cybersecurity frameworks and directives.
• Mentor and provide technical direction to junior team members engaged in RMF and A&A activities.

Education and Experience:
Required:

• Bachelor's Degree with an emphasis in Information Technology Security, Cybersecurity, or a related field from an accredited college or university. Extensive experience in the required discipline may serve as a substitution for the Bachelor's Degree requirement.
• Minimum of 7 years of experience in the certification and accreditation process of Information Systems within the U.S. Federal Government.
• Without a Bachelor's Degree, a minimum of 10+ years of experience in the certification and accreditation process of Information Systems within the U.S. Federal Government is required.
• Certified in accordance with most current DoW guidance as an IAM Level III.

Required Skills and Competencies:

• Exceptional communication skills in English – both written and oral – with the ability to effectively communicate complex security and risk concepts to both technical and non-technical stakeholders.
• In-depth knowledge and expertise across all steps of the RMF process as defined by NIST SP 800-37 and related publications.
• Extensive experience conducting security control assessments and residual risk determinations.
• Strong knowledge of NIST Special Publications, including SP 800-53, SP 800-53A, SP 800-30, and SP 800-137.
• Experience preparing and reviewing A&A documentation packages including SSPs, SARs, POA&Ms, and Risk Assessment Reports.
• Proficiency in applying a risk-based approach to security control selection and specification in compliance with applicable laws, Executive Orders, directives, policies, and regulations.
• Demonstrated experience serving as a team lead or senior subject matter expert in a federal government IT security environment.
• Strong understanding of the System Development Life Cycle (SDLC) and how security and risk management activities integrate throughout each phase.
• Ability to act as the primary point of contact and liaison between technical teams and government stakeholders on all RMF-related matters.
• Experience with continuous monitoring strategies and tools to ensure ongoing system authorization and compliance.
• Active ADP-II/Secret clearance.

Desired Skills and Competencies:

• Experience supporting DoD or other federal agency A&A efforts using tools such as eMASS (Enterprise Mission Assurance Support Service) or similar platforms.
• Familiarity with additional cybersecurity frameworks such as FISMA, FedRAMP, or CMMC.
• Experience with cloud security assessments and the application of RMF within cloud environments.
• IAM Level III certifications such as CISM, CISSP, or GSLC.
• Knowledge of zero trust architecture principles and their application within federal environments.
• Experience supporting or leading teams in a government contracting environment.
• Familiarity with vulnerability management tools and techniques, including STIG compliance and SCAP scanning.

Our Equal Employment Opportunity Policy

The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race, color, religion, creed, ethnicity, sex, sexual orientation, gender or gender identity (except where gender is a bona fide occupational qualification), national origin or ancestry, age, disability, citizenship, military/veteran status, marital status, genetic information or any other characteristic protected by applicable federal, state, or local law. We are committed to equal employment opportunity in all decisions related to employment, promotion, wages, benefits, and all other privileges, terms, and conditions of employment.

The company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or apply for a position on our website, please get in touch with Heaven Wood via e-mail at [email protected] or by calling 703-488-9377 to request accommodations.

Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions, Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag, we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical, professional, and operational solutions. KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery. We ensure long-term success with a continuous improvement approach while balancing the collective interests of our customers, employees, and native communities. For more information, please visit www.koniag-gs.com.

Equal Opportunity Employer/Veterans/Disabled. Shareholder Preference in accordance with Public Law 88-352