Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead

Job Description:

We are seeking an experienced Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead to oversee and execute cybersecurity activities supporting complex federal healthcare environments. The successful candidate will demonstrate a proven ability to lead multidisciplinary cybersecurity teams, manage multiple concurrent system authorization packages, and navigate the technical, regulatory, and operational challenges associated with federal information security programs.

This position requires a hands-on leader who can balance strategic oversight with direct technical contributions, taking ownership of team performance, deliverable quality, and the timely execution of cybersecurity activities. The ideal candidate possesses strong working knowledge of federal cybersecurity requirements, sound risk-based decision-making skills, and the ability to independently identify challenges, develop actionable solutions, and communicate effectively with government stakeholders, technical teams, and organizational leadership.

Basic Requirements:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, or an equivalent combination of relevant education and professional experience.
• Demonstrated professional experience supporting federal cybersecurity programs, including direct involvement in NIST RMF activities, FISMA compliance, and system authorization processes.
• Demonstrated experience leading or coordinating cybersecurity practitioners, managing competing priorities, and ensuring the quality and timely completion of technical and compliance deliverables.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53, and related federal information security requirements and guidance.
• Experience developing, reviewing, and maintaining system authorization documentation and supporting artifacts.
• Demonstrated ability to evaluate technical security findings, assess organizational risk, and recommend appropriate remediation or mitigation strategies.
• Strong written and verbal communication skills, including the ability to communicate cybersecurity risks and recommendations to technical personnel, government stakeholders, and organizational leadership.
• Ability to obtain and maintain the required federal Public Trust designation or other customer-required suitability determination.
• Must reside in and be authorized to work in the United States.
• Must meet applicable federal contract residency requirements, including having resided in the United States for at least three of the preceding five years.

Preferred Qualifications

• Experience supporting cybersecurity, risk management, and compliance activities within large-scale Salesforce implementations, including familiarity with Salesforce security architecture, access controls, data protection, integrations, and platform-specific security considerations.
• Experience working with cloud-based enterprise applications and infrastructure, particularly Amazon Web Services (AWS), in federal or similarly regulated environments.
• Experience utilizing security and development platforms such as Snyk, GitHub, Jira, and Confluence to support vulnerability management, DevSecOps activities, security documentation, and remediation tracking.
• Experience supporting federal healthcare programs or other complex federal civilian information systems.
• Experience coordinating security assessments, vulnerability remediation, and continuous monitoring activities across multidisciplinary technical teams.

Job Responsibilities:

The following describes the primary responsibilities associated with this position. Additional duties may be assigned based on program and organizational requirements.

Cybersecurity Leadership and Program Execution

• Lead and coordinate the day-to-day activities of cybersecurity practitioners supporting multiple federal information systems and authorization boundaries.
• Establish priorities, assign and monitor work activities, and ensure cybersecurity deliverables are completed accurately, consistently, and within established timelines.
• Provide technical direction, mentorship, and quality oversight to cybersecurity personnel while maintaining direct involvement in compliance activities.
• Coordinate cybersecurity activities with government stakeholders, system owners, technical teams, security assessors, and other program participants to support mission and authorization objectives.
• Identify emerging cybersecurity risks, operational challenges, and potential delivery issues; develop actionable recommendations and coordinate timely resolution.
• Monitor cybersecurity program performance, communicate status and risks to leadership, and identify opportunities to improve operational effectiveness and compliance processes.

Governance, Risk Management, and Authorization

• Lead and perform RMF activities throughout the system authorization lifecycle, including security categorization, control selection, implementation assessment, authorization support, and continuous monitoring.
• Oversee the development, review, and maintenance of authorization packages, including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), risk assessments, and supporting security documentation.
• Evaluate security control implementations and supporting evidence to determine compliance with applicable federal requirements and identify control deficiencies.
• Analyze security findings, vulnerabilities, and control weaknesses to assess potential mission impact, residual risk, and appropriate remediation or mitigation strategies.
• Coordinate the preparation, review, and submission of authorization artifacts and facilitate the resolution of findings or requests for additional information from security assessors and authorizing officials.
• Maintain visibility into authorization milestones, control deficiencies, remediation activities, and compliance obligations across assigned information systems.

Technical Security and Continuous Monitoring

• Execute and coordinate continuous monitoring activities to assess system security posture of federal information systems and ensure continued compliance with applicable security requirements.
• Execute, review, and interpret security and vulnerability scans, including those integrated into DevSecOps pipelines, to identify security weaknesses, assess risk, and evaluate compliance implications.
• Coordinate with the DevOps Lead and other technical stakeholders to prioritize, track, and validate remediation or mitigation activities associated with identified vulnerabilities and security control deficiencies.
• Assess the security implications of system modifications, configuration changes, infrastructure updates, and new technologies within authorized environments.
• Evaluate security controls and associated risks within cloud-based and hybrid environments, including those leveraging Amazon Web Services (AWS).
• Utilize enterprise cybersecurity and workflow management platforms to maintain authorization records, track security findings, coordinate remediation, and support reporting obligations.
• Perform hands-on technical security assessments, compliance reviews, evidence analysis, and other cybersecurity activities as required to support program objectives.

Stakeholder Engagement and Continuous Improvement

• Partner with the SecOps Lead to align RMF priorities, security assessments, vulnerability management, and remediation activities with technical security objectives, leveraging specialized expertise to resolve complex security challenges.
• Translate technical security findings and regulatory requirements into actionable recommendations appropriate for both technical and nontechnical stakeholders.
• Collaborate with government and contractor personnel to resolve security concerns, address authorization challenges, and support informed risk-based decisions.
• Identify opportunities to streamline RMF workflows, improve the consistency and quality of security documentation, and strengthen the effectiveness of continuous monitoring activities.
• Promote consistent cybersecurity practices, knowledge sharing, and professional development across the cybersecurity team.

Preferred Certifications:

Candidates possessing one or more of the following industry-recognized professional certifications will be preferred:

• Certified Information Systems Security Professional (CISSP) and/or Certified Secure Software Lifecycle Professional (CSSLP), issued by ISC2.
• Project Management Professional (PMP), issued by the Project Management Institute (PMI).
• AWS Certified Security – Specialty or other relevant AWS professional-level certifications.

All certifications must be current, active, and maintained in good standing.

Work Location:

This is a remote position open to qualified candidates residing within the United States. Candidates located within 50 miles of Woodlawn, Maryland, may elect to work on-site or in a hybrid capacity based on their individual preferences. On-site attendance is not required for this position.