Cybersecurity RMF Specialist

Dark Wolf is seeking a Cybersecurity RMF Specialist to serve as the primary regulatory and technical authority for the authorization of mission-critical software in DoD Impact Level 5 (IL5) and Impact Level 6 (IL6) enclaves. This role is responsible for the independent management of the end-to-end Risk Management Framework (RMF) process, including the development of a comprehensive Body of Evidence (BoE) for Continuous Authorization to Operate (cATO).

The successful candidate will act as the principal liaison between Platform Engineers, Developers, and Government stakeholders - including Security Control Assessors (SCA) and Authorizing Officials (AO) - to ensure the rigorous application of cybersecurity principles within a DoD operational ecosystem. This position requires a candidate capable of navigating complex cloud security requirements independently to achieve and maintain software readiness for national security systems.

Key Responsibilities:

• Leading the end-to-end RMF process specifically for DoD IL5 and IL6 environments, managing eMASS security controls, Artifacts, POA&Ms, and authorization documentation to maintain system compliance and security posture
• Managing Continuous Monitoring (ConMon) activities and security artifacts, including maintaining, reviewing, validating, and submitting STIG checklists, architecture/network diagrams, HW/SW inventories, PPSM documentation, SBOMs, container image inventories, and supporting evidence to the DHA Cybersecurity Team
• Coordinating ACAS/SAST Vulnerability scans, IAVA compliance, and remediation efforts with DHA Cybersecurity Team and Platform Engineers, tracking vulnerabilities and compliance findings through remediation and closure
• Translating DISA STIG, SRG, and NIST 800-53 requirements into actionable technical requirements, partnering with Platform/Engineers to implement security controls through Infrastructure as Code (IaC) and performing security control assessments
• Serving as the primary cybersecurity liaison for government stakeholders, supporting CCB/change requests and briefing DHA cybersecurity teams and senior leadership on system security posture, compliance status, risks, remediation efforts, and the path to continued authorization
• Required Qualifications: 5+ years of relevant Cybersecurity experience, with a focus on DoD RMF and Impact Level 5/6 authorizations
• Direct experience with DoD Cloud Service Providers (e.g. AWS Govcloud) ecosystems
• Proven ability to independently lead coordination with government Security Control Assessors (SCA) and mission partners
• Experience with eMASS and the Enterprise Mission Assurance Support Service for managing DoD system records
• Knowledge of security scanning tools (e.g., Static Analysis, Dynamic Analysis, etc.)
• Experience with using Atlassian tools such as Jira and Confluence
• Confidence in providing briefings, presentations, and in conducting/guiding meetings with senior leadership and stakeholders
• DoD 8140/8570 IAM Level III Certification (e.g., CISSP, CISM, or GSLC)
• US Citizenship and an active DoD Secret security clearance
• B.A. or B.S. Information Security, Computer Science or related discipline
• Desired Qualifications: Experience with the DoD Architecture Framework (DoDAF)
• Experience with Cloud Computing Security Requirements Guide (CC SRG)
• Experience with DoD DevSecOps Fundamentals Playbook
• Experience with DevSecOps Platforms such as GitLab or GitHub
• Understanding of container based application development tools (e.g., Docker, Docker Compose, Kubernetes)
• Understanding of "Continuous ATO" (cATO) concepts and the integration of automated security testing into DevSecOps pipelines
• This role requires a hybrid presence in Northern Virginia. The compensation for this role is estimated to be between $120,000-$150,000, commensurate on experience.
• We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories.
• In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire.
• We are strictly looking for direct, full-time W2 employees. We do not engage with third-party staffing agencies, C2C, or 1099 independent contractors for this role.