Cybersecurity Principal Specialist - GRC #542

Cybersecurity Principal Specialist - GRC #542

JOB OVERVIEW

Target Hiring Range: $145,000 - $165,000

Department: Chief Information Officer

Posting Date Range: 8/7/2026-8/21/2026

Pay Grade Range: $ -$

Work Hours: 8:30 a.m. - 5:30 p.m.

FLSA Status: Exempt

Work Location Status: Hybrid

Hybrid Schedule: 2-3 days a week onsite

All remote or hybrid work arrangements must be performed from within the continental United States, subject to Sergeant at Arms approval.

The Senate Sergeant at Arms does not pay for relocation expenses.

This vacancy announcement closes at 11:59pm EST. Late applications will not be accepted.

About Us

The Sergeant at Arms plays a crucial role in upholding the operational integrity of the Senate community. Our vision is to foster an environment of innovation, collaboration, and adaptability, ensuring uninterrupted legislative proceedings irrespective of time, place, or circumstance. The Cybersecurity department is responsible for protecting the systems and information used to create the legislation that underwrites our democracy. We create a resilient cybersecurity operation by pro-actively identifying, protecting, detecting, reacting, and recovering (IPDRR) the US Senate enterprise. We combine people, processes, and technology into a state of the art, continuous risk-reduction practice that is flexible, innovative, and effective.

Role Overview

The Cybersecurity RMF Technical Lead will serve within the Governance, Risk, and Compliance team of the Information Assurance Branch. In this technical leadership role, you will guide the modernization and day-to-day execution of a Senate‑specific Risk Management Framework program aligned with NIST guidance and tailored to the Senate mission environment. You will provide technical direction to RMF and policy professionals, advise system owners and cybersecurity teams, improve assessment and authorization processes, and help translate complex security findings into clear, actionable risk decisions. This role is ideal for a hands‑on RMF leader who can pair deep technical judgment with strong communication, process discipline, and a customer‑focused approach.

Key Responsibilities

• Serve as the technical lead for the Senate RMF program, including assessment and authorization (A&A), security control assessment, risk determination, authorization support, and continuous monitoring activities.
• Serve as a technical resource and subject matter expert for RMF and policy staff, providing guidance, quality review, and mentorship without formal supervisory authority.
• Modernize and mature a Senate‑tailored RMF program that aligns with NIST RMF principles, NIST SP 800‑53 controls, Senate‑specific requirements, and evolving cybersecurity priorities.
• Lead the development, review, and improvement of RMF artifacts, including system security plans, security assessment reports, plans of action and milestones (POA&M), risk registers, authorization packages, and continuous monitoring deliverables.
• Partner with system owners, technical teams, assessors, and leadership to identify risk, evaluate compensating controls, recommend mitigation strategies, and support risk acceptance decisions.
• Develop data‑driven metrics, dashboards, workflows, and reporting methods that improve RMF visibility, support prioritization, and measure program effectiveness.
• Analyze threats, vulnerabilities, control gaps, and cyber hygiene trends to support proactive risk management across Senate systems and networks.
• Communicate non‑compliance, risk findings, mitigation options, and RMF decisions clearly to technical and non‑technical audiences, including senior leadership.
• Collaborate with internal and external experts to ensure RMF content, policy, assessment methods, and reporting practices remain aligned with organizational needs, evolving threats, and industry benchmarks.

Desired Qualifications

• 7–10 years of progressively responsible cybersecurity experience, including significant time leading RMF, GRC, or information assurance program execution in a complex, highly governed, or mission‑focused environment.
• Demonstrated, hands‑on experience applying NIST RMF and NIST SP 800‑53 — assessing security controls and producing or reviewing authorization artifacts such as system security plans, security assessment reports, and POA&M.
• Ability to serve as a technical subject matter expert reviewing deliverables, advising on control implementation, and identifying risk without formal supervisory authority over staff.
• Strong written and verbal communication skills sufficient to translate technical risk findings into clear, actionable terms for both technical and senior leadership audiences.
• Experience applying RMF, GRC, and information assurance practices within a highly governed or regulated environment, such as federal government, military, legislative, financial services, or healthcare.
• One or more relevant professional certifications, such as CISSP, CGRC (formerly CAP), or CISM.
• Experience coordinating or informally leading project teams across multiple departments or stakeholder groups.
• Experience modernizing RMF, GRC, and continuous monitoring processes through automation, workflow design, metrics, or dashboards.
• Background in enterprise network architecture, vulnerability management, or incident response.
• Experience developing cybersecurity policy or strategy at an organizational level.

Skills and Abilities

• Technical leadership: Ability to guide RMF execution, review technical artifacts, mentor staff, and make sound, risk‑informed recommendations.
• Process improvement: Ability to translate complex risk management requirements into practical workflows, repeatable processes, and high‑quality documentation.
• Analytical judgment: Ability to identify control gaps, evaluate risk, assess mitigation options, and support decisions that balance compliance, security, operational needs, and mission impact.
• Documentation discipline: Ability to document RMF activities, procedures, decisions, and evidence clearly to improve traceability across the RMF lifecycle.
• Communication: Ability to present complex technical concepts, analyses, and recommendations in a confident, organized, and audience‑appropriate manner.

Key Accountabilities/Essential Job Duties

Provides functional and/or technical skills for the assigned cybersecurity unit. Supports the unit’s work effort as required in preparing materials for collaborating with other sections, divisions, departments, and vendors to gather and disseminate information. Contributes to the unit’s work effort as required in preparing analysis and materials for providing expert level support in the assigned area of cybersecurity to SAA IT security branch staff, other SAA technical staff, SAA procurement staff, and other division or departments; and for identifying and resolving critical and complex issues in the assigned unit. Supports the unit’s work effort as directed in providing leadership to the unit’s project teams and contractors. Work includes helping to develop plans, assignments, and coordination of work efforts. Supports the unit’s work effort to develop governing policies, standards, and procedures. Other duties as assigned.

JOB SPECIFICATIONS

Required Education

High School Diploma, GED

Required Work Experience

• Seven to ten years of progressively responsible experience in cybersecurity, with a track record of leading initiatives to resolve highly complex cybersecurity issues. Subject matter expertise in one or more cybersecurity domains. Strong leadership skills, including experience managing project teams and coordinating efforts across multiple departments.
• Demonstrated ability to develop and implement strategic cybersecurity policies, standards, and frameworks that align with organizational goals.

Working Conditions

• This position directly supports essential services of the U.S. Senate. As such, this position requires the employee be available and prepared to work during a government lapse in appropriations, in inclement weather, on holidays, weekends, and during late nights to ensure essential services to the Senate continue without interruption. In the context of government furloughs, this position is considered excepted.
• The U.S. Senate network cannot be taken offline for maintenance during the workday, or while the Senate is in session. As such, maintenance windows may only occur at night, on weekends, and occasionally on holidays. Employees who perform systems upgrades, maintenance, wiring, backups, support our alternate data centers will have schedules that include working nights, weekends, and holidays.
• Sedentary.
• This position may require the incumbent to be available for sudden recall in response to emergency events affecting the Senate campus/community, which may include after‑hour or weekend work, and to potentially deploy to alternate sites in support of the Senate’s contingency operations. (TCR)

Security Clearance

• This position requires that the applicant obtain and maintain a Secret U.S. Government security clearance.
• Applicants must be U.S. citizens in order for the SAA to submit your application for a security clearance.

CONDITIONS OF EMPLOYMENT

To be employed by a Senate employing office in a paid position in the continental United States an individual must:
1. Be a U.S. citizen;
2. Be lawfully admitted for permanent residence and seeking citizenship as outlined in 8 U.S.C. § 1324b(a)(3)(B);
3. Be (i) admitted as a refugee under 8 U.S.C. § 1157 or granted asylum under 8 U.S.C. § 1158 and (ii) have filed a declaration of intention to become a lawful permanent resident and then a citizen when eligible; or
4. Owe allegiance to the U.S. (i.e., qualify as a non‑citizen U.S. national under federal law).

Employment is contingent on background / security investigation results.

BENEFITS AT-A-GLANCE

The SAA provides a highly competitive benefits package for all SAA staff. Our benefits extend beyond health care coverage to help provide employees with student loan reimbursement, professional development, transportation subsidy, TSP/retirement savings, access to our Employee Assistance Program, and more! For more information regarding SAA’s benefits, please visit

ACCOMMODATIONS

As an Equal Opportunity Employer, the SAA is committed to providing reasonable accommodations to applicants with disabilities. If you are interested in applying for employment with SAA and need special assistance or an accommodation to complete the application process, please submit your request to with “Accommodation” in the subject line.

VOLUNTARY SELF-IDENTIFICATION FOR VETERANS' PREFERENCE

If you are identifying as veterans' preference eligible under the VEOA, please use this link to complete your application for Veterans' Preference AFTER you apply for this position. The link will also be available on the "Thank You" page after you have submitted your job application.

• All supporting documents must ONLY be provided within the Veterans’ Preference Application and within the stated deadline of the job announcement.
• Late applications for veterans’ preference will not be considered.
• Documentation to obtain veterans’ preference will not be considered if attached to the job application.
• If you need to revise or resubmit your Application for Veterans' Preference/documents, please withdraw your previous Application for Veterans' Preference and resubmit. If you require assistance, please email
• To view additional information regarding the VEOA, please click here.

An applicant who declines to self‑identify as a disabled veteran and/or to provide information and documentation regarding his/her disabled veteran’s status will not be subjected to an adverse employment action, but the individual may be ruled ineligible for veterans’ preference.