RMF/ISSO Analyst

Overview

DecisionPoint seeks a Senior RMF/ISSO Analyst to support Risk Management Framework, authorization, security-control assessment, and continuous-monitoring activities for the USMEPCOM ENLIST program.

The RMF/ISSO Analyst will maintain authorization artifacts, control implementation statements, interconnection agreements, continuous-monitoring evidence, and system-level Plans of Action and Milestones. This role will support Tenant Security Plan compliance, Authority to Operate and Authority to Connect package reviews, security-control testing, and Security Test and Evaluation planning and execution.

The successful candidate will work with the Government Information System Security Manager, system owners, technical teams, assessors, and other cybersecurity stakeholders to resolve review comments and maintain complete, accurate, and traceable authorization evidence.

This position is remote, with a preference for candidates located in the Chicago area.

Note: By applying to this position, you acknowledge and consent to having your resume included in an active competitive government contract bid.

Duties & Responsibilities

The RMF/ISSO Analyst will:

• Maintain Risk Management Framework authorization packages and supporting documentation throughout the system authorization lifecycle.

• Develop and maintain security-control implementation statements, control evidence, system security documentation, and continuous-monitoring records.

• Maintain system-level Plans of Action and Milestones, including findings, remediation actions, milestones, responsible parties, supporting evidence, and closure status.

• Develop, review, and maintain system interconnection agreements and related authorization documentation.

• Support compliance with the USMEPCOM Tenant Security Plan for the organization’s portion of the DoD Information Network Non-classified Internet Protocol Router Network.

• Support Authority to Operate and Authority to Connect package development, review, submission, maintenance, and renewal activities.

• Review authorization packages for accuracy, completeness, consistency, and traceability before Government or assessor submission.

• Evaluate security-control implementation and evidence against applicable NIST SP 800-53,