RMF Senior Analyst

Apply

Job Type

Full-time

Description

Missing Link Security is a government contractor with a mission to secure the nation's information by increasing awareness, countering threats, mitigating risks, and enforcing compliance. We employ individuals who are passionate about the security of our country, our communities, and our information systems.

Job Description: RMF Senior Analyst Company: Missing Link Security Location: Ft Belvoir, VA (on-site) Clearance Required: Secret Travel: Up to 5%

Background: The Risk Management Framework (RMF) is the process the Department of Defense and the Army use to assess, authorize, and continuously monitor the security of their information systems. The Army is reforming how it runs that process, moving from periodic, paperwork-heavy authorizations toward automation, continuous monitoring, and continuous assessment. Getting there takes people who know both the policy and how RMF actually works in the field.

Job Description: As an RMF Senior Analyst, you will support Headquarters, Department of the Army, DCS G-6 in leading RMF execution across the Army. You will carry out RMF execution and implementation support for Army Commands and cybersecurity stakeholders, report on the health of the Army's authorizations, assess how RMF is working on the ground, and help shape the Army's modernized approach to RMF and continuous monitoring.

Key Responsibilities:

• RMF Execution Support: Provide RMF execution and implementation support to Army Commands, giving cybersecurity stakeholders technical implementation guidance and directing them to the right cybersecurity organizations.
• Policy Compliance: Support DCS G-6 in meeting the requirements of DoDI 8500.01, DoDI 8510.01, AR 25-2, DA PAM 25-2-14, and related Federal, NIST, DoD, and Army issuances.
• RMF Status Reporting: Produce monthly reports on Army RMF execution and the migration to RMF 2.0, covering compliant authorizations, system and POA&M expirations, POA&M execution, and continuous monitoring (CONMON) implementation status.
• RMF Modernization and Automation: Support the modernization and implementation plan for a reformed, operationalized RMF, including a Continuous Assessment capability and a robotic process automation (RPA) strategy and pilot to automate RMF processes.
• Analysis and Technical Guidance: Prepare implementation plans, risk assessments, information papers, and recommendations on RMF tools and solutions, ISSM and SCA-V activities, annual FISMA requirements, and performance metrics for Army RMF operational assessments.
• Field Team Assessments: Take part in site-visit assessments and document a baseline status, areas for improvement, and recommendations for new strategies.
• Exception to Policy and Data Support: Support the Army's Commercial Temporary Exception to Policy (C-TEP) program under DoDI 8010.01, including package inventory, SNAP database registrations, and customer support, and contribute to an enterprise cybersecurity data dictionary.
• Stakeholder Coordination: Work with ASA(ALT), ARCYBER, NETCOM, HQDA staff, DISA, and DoD CIO, and with the team's Operational Technology Specialist as OT is integrated into the Army's cybersecurity capability.

Requirements

• Clearance: Active Secret security clearance. U.S. citizenship.
• Certification: DoD 8570.01-M / DoDD 8140.01 IAM Level II certification (e.g., CGRC/CAP, CASP+, CISM, CISSP).
• Experience: Proven experience supporting RMF for DoD or Army systems, including hands-on work in eMASS and the Army Portfolio Management System (APMS).
• Knowledge: In-depth understanding of RMF, system-level continuous monitoring, FISMA, FedRAMP and DISA FedRAMP, DISA STIGs, and Security Requirements Guides (SRGs).
• Skills: Strong analytical, writing, and briefing skills, with the ability to turn policy into clear guidance for commands and senior leaders.

Preferred Qualifications:

• Certifications: IAM Level III certification (e.g., CISSP, CISM, GSLC).
• Education: Degree in Cybersecurity, Computer Science, Information Systems, or a related field.
• Experience: Experience at the headquarters or enterprise level, such as HQDA, an Army Command, or an Authorizing Official's staff. Familiarity with operational technology and control systems risk assessment, and with automating RMF or continuous monitoring processes.
• Military Background: Experience working with or in the military, understanding military protocols and operational environments.

Missing Link Security does not discriminate in employment opportunities, terms, and conditions of employment, or practices on the basis of race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, or any characteristic protected by law.