ZipRecruiter

Log In

1

Nist Rmf Jobs in Maryland (NOW HIRING)

System One

Junior Security Control Assessor

Bethesda, MD · On-site

$100K - $115K/yr

  • Medical

  • Dental

  • Vision

  • Life

  • Retirement

NIST RMF (800-37) and NIST SP 800-53 Rev. 5 * JCAM methodology * Experience reviewing security documentation and assessment evidence/artifacts * Strong analytical skills and technical writing ability ...

previous pagenext page

Showing results 21-40

All JobsNist Rmf JobsNist Rmf Jobs in Maryland

Nist Rmf information

What is NIST RMF?

NIST RMF stands for the National Institute of Standards and Technology Risk Management Framework. It is a structured process used by federal agencies and organizations to identify, assess, and manage cybersecurity risks to information systems. The RMF provides a set of steps that guide organizations through the selection, implementation, assessment, and monitoring of security controls to ensure systems meet required security standards. This framework is essential for achieving compliance with federal cybersecurity requirements and improving overall information security.

What are the key skills and qualifications needed to thrive as a NIST RMF specialist?

To thrive as a NIST RMF specialist, you need a solid understanding of information security principles, risk assessment, compliance standards, and often a background in cybersecurity or IT, supported by certifications like CISSP, CAP, or Security+. Familiarity with NIST SP 800-37, eMASS, and other GRC (Governance, Risk, and Compliance) tools is typically required. Attention to detail, analytical thinking, and strong communication skills help professionals navigate complex regulatory requirements and effectively collaborate with stakeholders. These skills are essential for ensuring organizational compliance, safeguarding sensitive data, and managing security risks efficiently.

What are some typical challenges faced by professionals implementing the NIST RMF in an organization?

Professionals working with the NIST Risk Management Framework (RMF) often encounter challenges such as aligning organizational processes with RMF requirements, ensuring stakeholder buy-in, and maintaining comprehensive documentation. Adapting legacy systems to meet modern security controls can be complex, and coordinating efforts across multiple teams—such as IT, compliance, and management—requires strong communication skills. Staying current with evolving NIST guidelines and integrating continuous monitoring into daily operations are also important aspects to manage for success in this role.

What is the difference between Nist Rmf vs Cybersecurity Analyst?

AspectNist RmfCybersecurity Analyst
CertificationsRisk Management Framework (RMF) certifications, NIST guidelinesCompTIA Security+, CISSP, CEH
Work EnvironmentGovernment agencies, federal projects, compliance-focusedPrivate sector, IT departments, security teams
Industry UsagePrimarily in federal and defense sectorsAcross various industries including finance, healthcare, tech
Primary FocusImplementing and managing risk management frameworksMonitoring, analyzing, and responding to security threats

While Nist Rmf specialists focus on establishing and maintaining risk management processes based on NIST standards, Cybersecurity Analysts are more involved in threat detection and incident response. Both roles require security knowledge but serve different functions within cybersecurity frameworks.

What are popular job titles related to Nist Rmf jobs in Maryland?

For Nist Rmf jobs in Maryland, the most frequently searched job titles are:

What job categories do people searching Nist Rmf jobs in Maryland look for?

The top searched job categories for Nist Rmf jobs in Maryland are:

Nist Rmf jobs near you
Infographic showing various Nist Rmf job openings in Maryland as of August 2026, with employment types broken down into 79% Full Time, and 21% Contract. Highlights an 100% In-person job distribution.

Information Assurance / Security Specialist

Diverse Systems Group LLC

Bethesda, MD • On-site

Full-time

Re-posted 11 days ago

Job description

Description:

Overview:

Diverse Systems Group, LLC is seeking an Information Assurance Specialist to support Walter Reed National Military Medical Center (WRNMMC)’s system security authorization processes in compliance with the Department of Defense (DOD) and Defense Health Agency (DHA)’s NIST RMF related policies and requirements.


Job Summary:

  • Lead and perform Defense Health Agency (DHA)-specific Risk Management Framework (RMF)-related tasks throughout all stages of a system’s lifecycle to include:
  • stakeholder engagement and development of A&A or Threat Management Team project plans
  • preparation and maintenance of FIPS-199 system security categorization,
  • preparation and maintenance of FIPS-200 system security controls exceptions,
  • performance of risk assessments,
  • analysis of risk remediation and mitigation options and strategies,
  • development, review, and submission of Assessment & Authorization (A&A) system security packages,
  • selection and documentation of applicable NIST 800-53 rev. 4 security controls in systems’ Security Controls Traceability Matrices (SCTM),
  • collection, development, and analysis of NIST 800-53 rev 4-related security controls artifacts,
  • participation in and organizational oversight of Independent Verification & Validation (IV&V) activities,
  • development of and status tracking for Plans of Action & Milestones (POA&M),
  • performance of Continuous Diagnostics and Monitoring (CDM)-related activities, and
  • status tracking and reporting to leadership and organizational stakeholders.
  • Supports the year-round work of maintaining security posture to meet DoD RMF requirements.
  • Manage system security packages in DOD Enterprise Mission Assurance Support System (eMASS) throughout system authorization cycles, to include:
  • system registration
  • uploading and maintenance of system security packages,
  • Plans of Action & Milestones (POA&M) entry and tracking, and
  • system decommissioning.
  • Conduct and technology assessments, reviews, and technical inspections to identify and mitigate potential security weaknesses and to ensure all applicable security features and functionality are implemented and function as intended and required.
  • Work in partnership with System and Network Administrators to perform self-assessment and hardening of workstations, servers, network devices, and clinical devices to include application of Secure Technical Implementation Guidelines (STIG) and running hardening and security artifact collection scripts and Security Content Automation Protocol (SCAP) and Assured Compliance Assessment Solution (ACAS) scans.
  • Develop and maintain cybersecurity-related training materials and delivery of training for users and System Administrators (SA).
  • Possess and maintain comprehensive understanding of federal security regulatory requirements and security frameworks including DoD/DHA IT Security and IA policies, RMF, NIST SP 800-series, FISMA, FIPS, FedRAMP, policies, directives, and publications etc.
  • Proactively maintain awareness and understanding of current and emerging threats and vulnerabilities and their potential impact on organizational mission accomplishment, patient safety, and security of patient data.
  • Apply security patches, IAVAs, STIGS, and updates for all assigned systems
  • Provide support for the escalation and communication of status to agency management and internal customers and clearly communicate technical information to both technical and non-technical personnel
  • Implement and manage disaster recovery and COOP plans, systems, and operations.
  • Works collaboratively with team to ensure the following; Maintenance of baseline system security according to organizational policies, cyber threats and vulnerabilities are mitigated, and information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, and encryption) are adhered to.
  • Provide configuration management and accurately assess the impact of modifications and vulnerabilities for each system.
  • Maintain thorough understanding of NIST 800-53 controls, and determine which controls are applicable to the application, as well as document implementation in Security Controls Tractability Matrix (SCTM).
  • Oversee the monitoring and resolving Plan of Action and Milestones (POA&M) to mitigate system vulnerabilities on assigned Information Systems.
  • Ensures technical system documentation required for A&A packages are complete and clearly supports validation and ATO in accordance with system security requirements.
  • Performs comprehensive A&A tasks including package development, controls analysis, risk assessment, contingency planning, security test & evaluation, risk mitigation analysis, and technology assessments.
  • Utilizes application NIST and FIPS standards and guidance documents to register and complete accreditation packages in the DISA eMASS system.
  • Leads the RMF accreditation lifecycle for assigned systems from cradle to grave, managing stakeholder engagement, lifecycle progression, schedule development, accreditation package review, submission and validation.
  • Maintains and supports current and ongoing A&A packages to ensure an uninterrupted delivery of information technology systems for the organization.
  • Creates, manages, and maintains setup documentation and security policies for compliance and accreditation purposes for all programs, projects, including SOPs, Policies, Procedures, Plans, guidelines, checklists, presentations, training guides, etc… in alignment with the DOD/DHA IT organizational cybersecurity needs or in accordance with RMF guidelines.
  • Reports on assessment process status, participates in Independent Verification & Validation (IV&V) activities, conducts/oversees IV&V testing as required, and assists system certifiers during evaluations.
  • Reviews regulatory security policies, as well as best practices, and develop the technical solution required in order to implement those requirements on servers, routers, firewalls and other LAN/WAN equipment.
  • Works with System and Network Administrators to monitor the security posture of all networked systems and applications and take appropriate steps to quickly deal with any vulnerabilities.
  • Provides system, network, security engineering expertise and guidance for all aspects of information assurance, including those systems required to meet DoD regulations and requirements.
  • Manages the cybersecurity program to minimize risk and exposure across projects.
  • Oversee a team performing self-assessment and hardening of system servers, applying STIGs, SCAP and ACAS scans, and other scripts
  • Comprehensive understanding of DoD MHS services and programs, and other usability standards, as well as user interface design methodologies.
  • Other duties assigned as related to the Cybersecurity Division.


Supervisory Responsibility: No

Requirements:

Skills & Abilities:

  • Knowledge and experience with DOD RMF A&A artifacts, network architecture, network and security management and monitoring tools and penetration test tools.
  • Experience with deploying & hardening Windows Server 2012 R2, Server 2016, Server 2019
  • Experience with PowerShell, Tanium, SCAP, NMAP, SQL Developer, Forescout, and/or Splunk
  • Large Enterprise-level IT experience with maintenance of servers, storage devices and applications
  • Strong problem solving and critical thinking skills.
  • Strong planning & organizational skills.
  • Strong verbal and written communication skills to include delivery of presentations and communication of technical concepts to non-technical personnel that may span organizations and functional groups.
  • Strong verbal and written communication skills to include delivery of presentations and communication of technical concepts to non-technical personnel that may span organizations and functional groups.
  • Strong problem solving and critical thinking skills.

Education/Experience:

  • 5+ years of technical experience related to system and / or network administration and / or cybersecurity operations.

Certification(s):

  • Minimum certification level of CompTIA Security+ CE or equivalent certification required in accordance with DoDI 8140 / DoDD 8570 requirements (IAM/IAT Level 2)
  • CISSP, CAP, CYSA, CISM, MSCE or equivalent certification required.

Clearance:

  • DOD Secret security clearance required.

Nice to have:

  • Four-year college degree in Cybersecurity, Information Technology, Computer Information Systems, Computer Science, Computer Engineering, or equivalent. (Additional years of experience may serve in lieu of a degree)