Cybersecurity Engineer III - A&A / RMF Lead

Position Description: Our client is looking for a Cybersecurity Engineer III - A&A / RMF Lead for an onsite position in San Diego, CA. They are a government IT and cybersecurity contractor providing technology services to the U.S. Department of Defense and other federal agencies. ISS specializes in cybersecurity, network and systems engineering, IT infrastructure, software development, and technical support for mission-critical government programs.

Responsibilities: You will support the Naval Information Warfare Center Pacific (NIWC PAC) Information Technology Management Support Services contract.

The ideal candidate will serve as the technical lead for Assessment and Authorization (A&A) activities, overseeing the Risk Management Framework (RMF) accreditation lifecycle for DoD information systems. This individual will be responsible for driving systems through the authorization process, maintaining compliance with DoD cybersecurity requirements, and ensuring successful achievement and maintenance of Authorizations to Operate (ATOs).

The successful candidate will bring extensive hands-on RMF experience, strong leadership capabilities, and a proven track record of managing complex A&A accreditation efforts within DoD or federal environments.

• Lead Assessment & Authorization (A&A) efforts for DoD information systems, ensuring compliance with RMF requirements and successful achievement and maintenance of ATOs.
• Oversee the full RMF accreditation lifecycle, including security categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
• Lead the development, review, and maintenance of A&A documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Manage accreditation activities within eMASS, ensuring accurate documentation, milestone tracking, and timely completion of authorization requirements.
• Coordinate security control assessments, vulnerability assessments, STIG compliance reviews, and remediation efforts.
• Oversee scheduled accreditation activities, including quarterly Independent Verification and Validation (IV&V), quarterly STIG checks, Annual Security Reviews (ASRs), and monthly POA&M updates.
• Lead efforts to obtain, renew, and maintain ATOs and other applicable authorization decisions, including ATC, IATC, and IATT.
• Apply and tailor security controls based on system categorization, classification requirements, and applicable DoD security overlays.
• Evaluate security vulnerabilities, document findings, develop mitigation strategies, and coordinate remediation with technical teams.
• Serve as the primary A&A/RMF subject matter expert, providing technical guidance to cybersecurity engineers, system administrators, and program stakeholders.
• Coordinate with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), Security Control Assessors (SCAs), and Authorizing Officials (AOs) throughout the accreditation process.
• Support DISA circuit accreditation requirements, inherited security controls, and cloud service provider authorization documentation.
• Ensure cybersecurity documentation and accreditation activities comply with applicable DoD, NIST, and DISA requirements.

• 10+ years of cybersecurity experience, preferably supporting DoD, Navy, or federal government environments.
• Active Secret security clearance.
• IAM Level II certification meeting applicable DoD requirements (accepted certifications to be confirmed with ISS).
• Extensive hands-on RMF and A&A experience, including leading accreditation efforts for DoD information systems.
• Proven experience obtaining and maintaining ATOs, with demonstrated ownership of accreditation packages and authorization activities.
• Advanced proficiency with eMASS, including managing accreditation workflows, POA&Ms, security controls, and authorization documentation.
• Strong experience developing and reviewing SSPs, SAPs, SARs, and POA&Ms.
• Experience conducting security control assessments, STIG compliance reviews, vulnerability assessments, and remediation tracking.
• Strong understanding of NIST SP 800-53, NIST SP 800-37, DoD RMF, and DISA STIG requirements.
• Demonstrated ability to lead A&A activities, coordinate cross-functional technical teams, and communicate with government stakeholders.

Preferred Qualifications:

• Previous experience supporting NIWC PAC, Navy, or other DoD cybersecurity programs.
• CISSP, CISM, CGRC (formerly CAP), or other relevant advanced cybersecurity certifications.
• Prior experience serving as an A&A Lead, RMF Lead, ISSM, or Senior ISSO.
• Experience managing multiple concurrent accreditation packages and complex authorization schedules.
• Familiarity with DISA circuit accreditation, cloud security control inheritance, and classified information systems.
• Experience mentoring cybersecurity professionals or providing technical leadership to A&A teams.