RMF Process Lead (R-00177)

Team: Security Analyst Team

Location: 100% Remote

Commitment: Full-Time

Workplace Type: remote

Position Responsibilities

Roles and Responsibilities

• Own and manage the end-to-end RMF lifecycle, including system categorization, control selection, implementation, assessment, authorization, continuous monitoring, and system disposal.
• Assess and document current-state RMF processes, workflows, roles, data requirements, dependencies, pain points, and approval paths.
• Design and implement standardized target-state RMF processes aligned with NIST, federal agency, and organizational requirements.
• Translate existing RMF workflows, business rules, security documentation, control data, and authorization activities into the new GRC or RMF platform.
• Serve as the primary functional subject matter expert for the new RMF solution, including its workflows, data model, configurations, reporting, and user capabilities.
• Lead requirements-gathering sessions with system owners, ISSOs, ISSMs, security control assessors, authorizing officials, engineers, and compliance stakeholders.
• Define functional requirements, user stories, acceptance criteria, workflow rules, role-based permissions, notifications, and approval processes.
• Review and validate the migration of system records, security controls, assessment results, POA&Ms, authorization packages, evidence, and supporting documentation.
• Identify process gaps, data-quality issues, control-mapping inconsistencies, and configuration deficiencies, and coordinate corrective actions.
• Establish RMF governance standards, operating procedures, templates, process guides, decision points, and quality-control requirements.
• Coordinate solution testing, user acceptance testing, process validation, defect resolution, and production-readiness activities.
• Develop training materials and provide role-based training, demonstrations, and knowledge transfer for users of the new RMF solution.
• Monitor RMF process performance, authorization timelines, control-assessment status, POA&M remediation, and continuous-monitoring activities.
• Provide leadership with dashboards, status reports, risk summaries, implementation updates, and recommendations for process improvement.
• Drive user adoption and continuous improvement by incorporating stakeholder feedback, regulatory changes, lessons learned, and emerging cybersecurity requirements.

 

Position Qualifications

• Bachelor’s degree in cybersecurity, information technology, information systems, engineering, business, or a related field.
• Eight or more years of experience supporting cybersecurity governance, risk management, compliance, security authorization, or RMF programs.
• Demonstrated experience leading or owning end-to-end RMF processes within a federal government or highly regulated environment.
• Expert knowledge of NIST RMF, NIST SP 800-37, NIST SP 800-53, FIPS 199, FIPS 200, and continuous-monitoring requirements.
• Experience translating current-state business processes into standardized target-state workflows within a new technology platform.
• Experience implementing, configuring, migrating to, or supporting enterprise GRC or RMF platforms such as RegScale, GRC, RSA Archer, eMASS, Xacta, CSAM, or equivalent solutions.
• Strong understanding of authorization packages, System Security Plans, security controls, assessment procedures, POA&Ms, risk assessments, and authorization decisions.
• Experience facilitating process-mapping, requirements-gathering, solution-design, testing, and stakeholder-validation sessions.
• Ability to translate technical, regulatory, and operational requirements into clear system configurations, workflows, and user procedures.
• Strong analytical, documentation, presentation, communication, and stakeholder-management skills.
• Experience leading cross-functional teams and coordinating with system owners, cybersecurity personnel, assessors, engineers, program managers, and executive leadership.
• Ability to identify process risks, resolve competing requirements, and guide stakeholders toward standardized enterprise solutions.

Role Summary

The RMF Process Lead will own and govern the organization’s Risk Management Framework processes and lead the transition from current-state RMF workflows to a modernized target-state solution. This role requires deep knowledge of federal cybersecurity requirements, security authorization processes, control implementation, and enterprise GRC platforms. The RMF Process Lead will serve as the functional subject matter expert for the new solution, translate existing processes and data into optimized workflows, and ensure consistent adoption across cybersecurity, system owner, assessor, and authorization teams.