Security Analyst – Risk Management Framework (RMF) / Assessment & Authorization

Position Title:Security Analyst – Risk Management Framework (RMF) / Assessment & Authorization

Location: Remote with Hybrid Work in Maryland

Citizenship: U.S. Citizenship required

Employment Type: Full-Time

How to Apply

Email your resume:careers@wintrio.com

Position Overview

WINTrio is seeking an experienced Security Analyst with strong Risk Management Framework (RMF), Assessment & Authorization (A&A), and Authority to Operate (ATO) experience to support USDA information systems.

The position requires hands-on experience developing and maintaining Federal RMF/A&A packages and working with NIST and agency security requirements. USDA RMF and USDA CSAM experience are highly desirable.

Key Responsibilities

• Collect, review, and update system information.
• Create and maintain system records in Cybersecurity Assessment and Management System (CSAM).
• Develop/update and upload Privacy Threshold Analyses (PTAs).
• Perform and document system security categorization.
• Develop/update Privacy Impact Assessments (PIAs).
• Develop/update E-Authentication Risk Assessments.
• Maintain system identification information and system/technical narratives within CSAM.
• Identify common and inherited security controls.
• Develop and maintain compliance descriptions for security controls.
• Support security-control tailoring.
• Develop compensating controls where required.
• Develop/update:
• Contingency Plans (CP)
• CP test, training, and exercise documentation
• System of Records Notices (SORN)
• Configuration Management Plans (CMP)
• Incident Response Plans (IRP)
• Business Impact Assessments (BIA)
• Interconnection Security Agreements (ISA)
• Finalize System Security Plan (SSP) compliance descriptions.
• Finalize Contingency Plans.
• Finalize CMPs, IRPs, and Disaster Recovery Plans where applicable.
• Review RMF packages for completeness and readiness.
• Assist USDA REE stakeholders in resolving findings and updating documentation during concurrence review.

Required Qualifications

• Working knowledge of:
• NIST Risk Management Framework
• FIPS PUB 199
• NIST SP 800-53 Rev. 4/5
• NIST SP 800-37 Rev. 2
• NIST SP 800-171 Rev. 2
• NIST SP 800-47 Rev. 1
• Experience developing security-control implementation/compliance descriptions.
• Experience developing Federal security and authorization documentation such as SSPs, CPs, CMPs, IRPs, BIAs, PIAs, ISAs, and related RMF artifacts.
• Experience using CSAM or a comparable Federal governance, risk, and compliance/RMF system.
• Experience completing all aspects of the NIST RMF process.
• Ability to work collaboratively with system owners, ISSOs/ISSMs, technical teams, privacy personnel, and Government security stakeholders.
• Strong technical writing, documentation, analytical, and quality-assurance skills.
• Must be able to satisfy applicable background investigation/Public Trust, HSPD-12, PIV, and facility/system access requirements.

Highly Desired Qualifications

• Previous experience supporting USDA RMF programs.
• Working knowledge of:
• USDA Risk Management Framework 2.0
• USDA Six-Step RMF Process
• USDA Departmental Regulation 3540-003, Security Assessment and Authorization
• USDA POA&M procedures
• Hands-on experience with the USDA CSAM instance.
• Previous USDA or other Federal civilian agency cybersecurity experience.
• Experience obtaining ATOs for FedRAMP products, platforms, or solutions.
• Experience supporting FISMA-regulated Federal systems.
• Prior participation in similar Federal RMF/A&A projects.

Work Environment

• Full-time position.
• Primarily remote within the United States.
• Occasional on-site support may be requested in the Washington, DC / Northern Virginia area.
• Standard Federal business hours.
• All work must be performed within the United States.

WINTrio Benefits

• Healthcare, Medical, Dental, and Vision
• FSA and HSA options
• 401(k) Retirement Plan
• Annual Bonus and Profit Sharing Opportunities
• Paid Time Off
• Employee Assistance Program
• Life and Disability Insurance

Equal Opportunity Employer

WINTrio LLC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to any characteristic protected by applicable law.