Description
The Risk Management Framework (RMF) Analyst plays a crucial role in obtaining and maintaining the authorization of core infrastructure systems managed by Data Center and Cloud Hosting Services. This individual will be responsible for using Enterprise Mission Assurance Support Services (eMASS) to capture information and artifacts required to obtain and maintain an authorization in accordance with the Department of Navy (DoN) Risk Management Framework Process Guide, Navy Security Control Assessor Risk Assessment Guide, CYBERSAFE requirements and other agency-specific policies. The RMF Analyst will work closely with system owners, developers and security personnel to identify, assess and mitigate risks throughout the system lifecycle. As a RMF Analyst, a solid understanding of the Navy's risk management framework process and experience using authorization tools, eMASSter and RAFT, is required.
Essential Duties and Responsibilities:
1. RMF Implementation and Maintenance:
Develop and maintain RMF documentation, including but not limited to System Security Plans (SSPs), Security Assessment Plans (SAPS), Security Assessment Reports (SARs) and Plans of Action and Milestones (POA&Ms)
Determine appropriate applicable security controls based on National Institute of Standards and Technology (NIST) 800-53 and other relevant guidance
Test and monitor security controls to ensure effectiveness
Review and understand how to assess technical test results (i.e. Assured Compliance Assessment Solution (ACAS) scan results, Security Content Automation Protocol (SCAP) scan results, EvaluateSTIG scan results, STIG checklists) and collaborate with system engineers and cybersecurity teams to ensure findings are addressed
Conduct regular security reviews and audits to ensure compliance with cybersecurity requirements
Review and update Department of Defense Information Technology Portfolio Repository - Department of the Navy (DITPR-DON) records, if one exists, for assigned system
2. Collaboration and Communication:
Collaborate with system owners, developers and other stakeholders to integrate security into all phases of the system development lifecycle (SDLC)
Provide guidance and support to system owners on RMF requirements and best practices
Communicate security risks and recommendations to management and other stakeholders effectively
3. Continuous Improvement:
Stay abreast of emerging security threats and vulnerabilities
Identify opportunities to improve RMF processes and documentation
Qualifications
Required Education and Experience:
Bachelor's degree and five (5) or more years of experience
Require at least one: CompTIA Security+, CompTIA Advanced Security Practitioner (CASP), or Certified Information System Security Professional (CISSP)
RMF and IV&V experience
Must be a US Citizen with an active Secret clearance and the ability to obtain a Top Secret
REQNUMBER: 2506085
SAIC is a premier technology integrator, solving our nation's most complex modernization and systems engineering challenges across the defense, space, federal civilian, and intelligence markets. Our robust portfolio of offerings includes high-end solutions in systems engineering and integration; enterprise IT, including cloud services; cyber; software; advanced analytics and simulation; and training. We are a team of 23,000 strong driven by mission, united purpose, and inspired by opportunity. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $6.5 billion. For more information, visit saic.com. For information on the benefits SAIC offers, see Working at SAIC. EOE AA M/F/Vet/Disability