Senior RMF Security Analyst

Diligent Solutions is seeking a Senior RMF Security Analyst to support federal information systems through RMF Steps 1–3 . In this hands‑on role, you will develop and maintain RMF security documentation to help systems achieve, maintain, and renew Authorities to Operate (ATOs) .

This position is based in Gaithersburg, MD on a hybrid schedule, with work focused on producing accurate, complete, and review‑ready authorization package artifacts.

Key Responsibilities

• Collect and update general system information for federal RMF documentation.
• Create and maintain system records in CSAM , including system identification information, system descriptions, and technical narratives.
• Prepare and update Privacy Threshold Analyses (PTAs) and Privacy Impact Assessments (PIAs) .
• Perform and update FIPS 199 security categorizations.
• Perform and update E-Authentication Risk Assessments .
• Identify common and inherited security controls, including controls inherited from FedRAMP-authorized services.
• Develop and update compliance descriptions for applicable NIST SP 800-53 controls, including tailoring decisions.
• Develop and update compensating controls when required.
• Develop and update Contingency Plans and related testing and training documentation.
• Develop and update documentation including System of Records Notices , Configuration Management Plans , Incident Response Plans , Business Impact Assessments , and Interconnection Security Agreements .
• Finalize System Security Plan compliance descriptions.
• Finalize Contingency Plans , Configuration Management Plans , Incident Response Plans , and Disaster Recovery Plans , as required.
• Assist government stakeholders with addressing findings and updating documentation during concurrence and authorization reviews.
• Coordinate with technical and business stakeholders to ensure RMF documentation is accurate, complete, consistent, and ready for authorization review.

Requirements

• U.S. citizenship .
• Bachelor’s degree and at least eight years of relevant cybersecurity experience.
• Experience completing all aspects of the NIST Risk Management Framework for federal information systems.
• Hands‑on experience developing and maintaining federal A&A and authorization packages.
• Working knowledge of the NIST Risk Management Framework .
• Working knowledge of FIPS PUB 199 .
• Working knowledge of NIST SP 800-53 Rev. 4 and/or Rev. 5 .
• Working knowledge of NIST SP 800-37 Rev. 2 .
• Working knowledge of NIST SP 800-171 Rev. 2 .
• Working knowledge of NIST SP 800-47 Rev. 1 .
• Working knowledge of other publications and guidance related to the federal RMF process.
• Hands‑on experience using Cybersecurity Assessment and Management System (CSAM) .
• Experience supporting ATOs involving FedRAMP-authorized products, solutions, or platforms.
• Experience developing SSPs , contingency plans, incident response plans, configuration management plans, business impact assessments, interconnection security agreements, and privacy documentation.
• Strong technical‑writing skills, with the ability to produce accurate, complete, and Section 508‑compliant documentation.
• Ability to appropriately handle Controlled Unclassified Information and other sensitive government information.
• Ability to successfully obtain and maintain the required federal background investigation, suitability determination, facility access, and PIV credential .

Technology and Standards

• Cybersecurity Assessment and Management System (CSAM)
• FedRAMP
• NIST Risk Management Framework
• FIPS PUB 199
• NIST SP 800-53 Rev. 4 and NIST SP 800-53 Rev. 5
• NIST SP 800-37 Rev. 2
• NIST SP 800-171 Rev. 2
• NIST SP 800-47 Rev. 1
• Section 508

Location

• Hybrid (Beltsville, Maryland)

Preferred Qualifications

• Prior federal civilian‑agency A&A experience.
• Prior USDA cybersecurity or RMF experience is a plus.
• Experience with the USDA Six‑Step RMF Process or USDA CSAM instance is a strong plus.
• Experience independently supporting RMF activities across multiple federal information systems.
• Active certification such as CISSP , CGRC (formerly CAP), or CISM .
• Current or prior federal Public Trust investigation.