The Role
Lead RMF lifecycle activities for Air Force FM systems: develop and sustain authorization artifacts, perform vulnerability and risk assessments, coordinate remediation, track enterprise authorization status, and brief senior leaders. Provide policy-to-implementation guidance, maintain version-controlled documentation, and support incident/continuity activities and AO decision packages.
Summary Generated by Built In
cFocus Software seeks a Sr. Cybersecurity Analyst to join our program supporting the United States Air Force. This position is onsite with the onsite location being in Ellsworth, South Dakota. This position requires a TS/SCI SSBI clearance.
Qualifications:
Duties:
Qualifications:
- Active TS/SCI SSBI clearance
- B.S. Computer Science, Information Technology, or a related field
- 10+ years of RMF/Cybersecurity experience
- Advanced experience leading RMF, Assessment and Authorization, and continuous-monitoring activities for multiple federal or DoD information systems.
- Expert knowledge of federal, DoD, and Air Force cybersecurity policy and the ability to convert policy into practical, system-level implementation guidance.
- Demonstrated experience developing and evaluating SSPs, RARs, POA&Ms, security-control evidence, authorization decision packages, and mission-impact analyses.
- Hands-on proficiency with eMASS and ITIPS or equivalent federal authorization and portfolio-governance systems.
- Advanced vulnerability assessment, risk analysis, mitigation planning, remediation coordination, and trend-reporting experience.
- Ability to assess security controls, determine control effectiveness, document weaknesses and residual risk, and recommend risk-informed courses of action.
- Experience briefing senior leaders and supporting Authorizing Officials, AODRs, system owners, program offices, governance forums, and technical teams.
- Strong technical writing, analytical, quality-control, stakeholder-management, and version-control skills.
- Ability to manage simultaneous authorization actions and recurring deliverables while meeting PWS deadlines and maintaining artifact currency.
- Ability to work primarily at Ellsworth AFB during the PWS duty-hour window and support rare work at Wright-Patterson AFB or a contractor facility when required.
- Active DoD 8140 certification
Duties:
- Lead comprehensive Risk Management Framework lifecycle support across the DAF FM portfolio, including security control selection, implementation, validation, authorization, and continuous monitoring.
- Provide expert advisory support to the FM Authorizing Official, AODR, and program offices on the compliant application of federal, DoD, and Air Force cybersecurity policy.
- Analyze cybersecurity statutes, regulations, directives, standards, policies, and guidance and translate them into actionable implementation requirements for FM systems.
- Develop, manage, review, and sustain authorization artifacts for multiple systems, including System Security Plans, Risk Assessment Reports, Plans of Action and Milestones, control evidence, and related records in eMASS and ITIPS.
- Assess security controls; document gaps, weaknesses, associated risk levels, and recommended remediation strategies.
- Conduct vulnerability assessments, perform technical and mission risk analysis, identify systemic issues, and design defensible mitigation strategies across the FM portfolio.
- Coordinate vulnerability and POA&M remediation with system owners, cybersecurity personnel, engineers, and program management offices; validate closure evidence and residual risk.
- Track and report enterprise-wide vulnerability trends, authorization status, ATO expiration dates, remediation progress, POA&M closure rates, overdue items, and escalation conditions.
- Prepare complete, high-quality staffing packages for authorization decisions, including risk analysis, control summaries, mission impact, and recommendations for ATO, ATO with Conditions, or Denial.
- Develop Mission Impact Assessments and presentation materials for AO decision meetings.
- Facilitate communication among system owners, security personnel, program offices, and the FM AO to resolve information-assurance and authorization issues.
- Prepare and deliver cybersecurity status updates, leadership briefings, annual program reviews, policy/guidance updates, and materials for governance forums and working groups.
- Maintain the FM systems inventory and boundary documentation, including points of contact, authorization status, and ATO expiration information.
- Support configuration, readiness, and technical reviews by evaluating cybersecurity risk, control implementation, change impacts, and production-readiness evidence.
- Maintain accurate, current, version-controlled cybersecurity documentation and provide auditable evidence supporting QASP performance objectives.
- Support COOP, contingency, incident, and other mission-continuity activities when requested by the PMO.
Skills Required
- Active TS/SCI SSBI clearance
- B.S. in Computer Science, Information Technology, or related field
- 10+ years of RMF/Cybersecurity experience
- Advanced experience leading RMF, Assessment and Authorization, and continuous-monitoring activities
- Expert knowledge of federal, DoD, and Air Force cybersecurity policy and translating policy into system-level guidance
- Experience developing and evaluating SSPs, RARs, POA&Ms, security-control evidence, authorization decision packages, and mission-impact analyses
- Hands-on proficiency with eMASS and ITIPS or equivalent federal authorization and portfolio-governance systems
- Advanced vulnerability assessment, risk analysis, mitigation planning, remediation coordination, and trend-reporting experience
- Ability to assess security controls, document weaknesses and residual risk, and recommend risk-informed courses of action
- Experience briefing senior leaders and supporting Authorizing Officials, AODRs, system owners, program offices, and technical teams
- Strong technical writing, analytical, quality-control, stakeholder-management, and version-control skills
- Ability to manage simultaneous authorization actions and recurring deliverables while meeting PWS deadlines
- Ability to work primarily at Ellsworth AFB and support occasional work at Wright-Patterson AFB or contractor facility
- Active DoD 8140 certification
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 2006, cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint. cFocus Software is the exclusive vendor of ATO (Authority To Operate) as a Service™, which automates FedRAMP compliance for the Azure Government Cloud and Office 365. Contact Us for a demo of ATO as a Service™ or a FREE government chatbot proof of concept project today!
