The Role
Lead and manage the RMF lifecycle and ATO process for federal systems under NIST 800-53 Rev.5. Develop A&A artifacts and authorization packages, maintain enterprise risk register and POA&Ms, drive continuous monitoring, support audits, provide RMF guidance to system owners, and coordinate risk reporting and remediation oversight.
Summary Generated by Built In
Company Overview
Development InfoStructure LLC., (Devis) is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.
Job Overview
The RMF / ISSO Lead serves as the leader for the Risk Management Framework (RMF) program and Authority to Operate (ATO) lifecycle under the Information Security Program Support Services (ISPSS) effort supporting the NIH Office of the Director, Office of Information Technology (OD OIT), responsible for managing the RMF lifecycle under NIST 800-53 Rev. 5, leading Assessment and Authorization (A&A) package development, and maintaining the enterprise risk register and POA&Ms. This role drives execution across system categorization and authorization, continuous monitoring, audit and assessment support, and RMF guidance to system owners and ISSOs in close coordination with NIH/OD OIT leadership.
This is a full-time position with work performed primarily offsite, though travel to NIH/OD facilities in the Bethesda, MD area will be required on an as-needed basis. Core hours are Monday-Friday, 7:00 AM - 6:00 PM EST, and after-hours support for emergency incidents will be required as needed by NIH/OD. Position is contingent upon award and client approval.
Primary Duties
Lead RMF Program & GovernancePreferred Qualifications
Clearance
Salary Range
Development InfoStructure LLC., (Devis) is a leading provider of innovative software development, management, and consulting services, specializing in cutting-edge technologies such as DevSecOps, AI, and Machine Learning. With over 30 years of experience, we have established ourselves as a trusted partner for government agencies, delivering tailored, mission-critical solutions that drive digital transformation and operational excellence. Our client-centric approach, coupled with our deep domain expertise and technical prowess, enables us to forge enduring relationships and consistently deliver high-impact, adaptive solutions that resonate with the unique needs of the public sector.
Job Overview
The RMF / ISSO Lead serves as the leader for the Risk Management Framework (RMF) program and Authority to Operate (ATO) lifecycle under the Information Security Program Support Services (ISPSS) effort supporting the NIH Office of the Director, Office of Information Technology (OD OIT), responsible for managing the RMF lifecycle under NIST 800-53 Rev. 5, leading Assessment and Authorization (A&A) package development, and maintaining the enterprise risk register and POA&Ms. This role drives execution across system categorization and authorization, continuous monitoring, audit and assessment support, and RMF guidance to system owners and ISSOs in close coordination with NIH/OD OIT leadership.
This is a full-time position with work performed primarily offsite, though travel to NIH/OD facilities in the Bethesda, MD area will be required on an as-needed basis. Core hours are Monday-Friday, 7:00 AM - 6:00 PM EST, and after-hours support for emergency incidents will be required as needed by NIH/OD. Position is contingent upon award and client approval.
Primary Duties
Lead RMF Program & Governance
- Manage the RMF lifecycle for new and existing systems and maintain continuous compliance with the NIST 800-53 Rev. 5 baseline
- Maintain the enterprise Risk Management Strategy, RMF Program Plan, common controls, and tailored baselines
- Provide RMF subject matter expertise and guidance to system owners, ISSOs, and stakeholders
- Support C-SCRM and EO 14028 requirements, including third-party/SBOM risk analysis
- Develop and maintain RMF authorization artifacts: SSP, BIA, FIPS 199 categorization, PTA/PIA, Configuration Management Plan, and e-Authentication documentation
- Develop boundary/architecture documents (BSM, ABND) and support control scoping, tailoring, and overlays (e.g., OD AI Overlay; NIST AI RMF 1.0 for AI/ML systems)
- Provide governance and final QA review of System Authorization Packages prior to submission to the Authorizing Official
- Maintain independence: package developers shall not perform SCA/SAR validation for the same system
- Populate and maintain the enterprise Risk Management Register and manage POA&Ms to timely remediation
- Identify, prioritize, and provide enhanced oversight for High Value Assets (HVAs)
- Coordinate and execute annual Contingency Plan Tests and maintain ConMon plans
- Communicate risk posture, compliance status, and authorization updates to senior leadership
- Support internal/external assessments and audits (OIG, GAO, HHS, independent assessors) and track corrective actions
- Manage the Risk Mitigation Waiver Register and annual waiver reassessment
- Facilitate RMF training, office hours, and how-to guides for system owners and technical staff
Required Qualifications
Education & Experience
- Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related field (or equivalent experience)
- Minimum 7 years in RMF / A&A / ISSO support for federal systems
- Demonstrated experience managing the ATO lifecycle and POA&Ms under NIST 800-53
- CISSP, CAP, or CGRC (or comparable RMF/GRC certification)
- Strong working knowledge of NIST RMF, NIST 800-53 Rev. 5, FIPS 199/200, and FISMA
- Experience authoring SSPs and full A&A packages; familiarity with GRC/compliance tools (e.g., JCAM)
- Familiarity with FedRAMP CSP package review and control inheritance
- Clear written documentation and the ability to guide system owners through complex RMF processes
- Strong organization and tracking discipline across many concurrent authorizations
- Prior NIH/HHS RMF or ISSO support experience
- Experience with AI/ML security overlays and NIST AI RMF 1.0
- Cloud A&A experience (FedRAMP, NIH STRIDES)
Clearance
- Must be able to obtain and maintain the NIH/OD/OIT required clearance level and complete all suitability/onboarding requirements
Salary Range
- $110,000 - $130,000
Skills Required
- Bachelor's degree in Information Systems, Cybersecurity, Computer Science, or related field (or equivalent experience)
- Minimum 7 years in RMF / A&A / ISSO support for federal systems
- Demonstrated experience managing the ATO lifecycle and POA&Ms under NIST 800-53
- CISSP, CAP, or CGRC (or comparable RMF/GRC certification)
- Strong working knowledge of NIST RMF, NIST 800-53 Rev. 5, FIPS 199/200, and FISMA
- Experience authoring SSPs and full A&A packages; familiarity with GRC/compliance tools (e.g., JCAM)
- Familiarity with FedRAMP CSP package review and control inheritance
- Clear written documentation skills and ability to guide system owners through RMF processes; strong organization and tracking discipline
- Must be able to obtain and maintain the NIH/OD/OIT required clearance level and complete all suitability/onboarding requirements
- Prior NIH/HHS RMF or ISSO support experience
- Experience with AI/ML security overlays and NIST AI RMF 1.0
- Cloud A&A experience (FedRAMP, NIH STRIDES)
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Development InfoStructure, LLC. (Devis) is a leading provider of IT consulting services and solutions to the Federal, State and Local Governments, as well as the international development community. Devis helps maximize your return on IT investment by: 1) working with the best-adapted programming languages, databases and other solutions for your specific project; 2) actively supporting the open source community; and 3) using and promoting open technology standards. Devis has extensive experience with world wide software deployments and support. Our systems operate in more than 80 countries, and in every federal department. Devis-built systems involve the full vertical spectrum of users from data entry clerks to Governement managers to Congress
