SAIC

Risk Management Framework Analyst

SAIC • $95K — $115K *
Colorado Springs, CO 80918In-Person
Aerospace & Defense
Less than 5 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • Intermediate level certification as per DoD Manual 8140.03 (e.g., CompTIA Security+).
  • Bachelor’s degree in information assurance, cybersecurity, or related field, or equivalent experience.
  • 3-5 years of relevant experience in cybersecurity, or 7-10 years with a high school diploma.
  • 2 years of direct ISSO or cybersecurity practitioner experience with DoD systems.
  • Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance.

Responsibilities

  • Support RMF processes across enterprise systems, maintaining system registrations and security baselines.
  • Independently drive continuous monitoring and ATO sustainment as an ISSO.
  • Ensure consistent maintenance of cybersecurity standards for Cyber Operational Readiness Assessments.
  • Manage cybersecurity posture and compliance with DoD directives and NIST requirements.
  • Analyze scan results from various assessment tools to evaluate system risks and security posture.
  • Assist with system categorization according to CNSSI 1253 standards.
  • Lead the development and maintenance of System Security Plans and validate security architecture.

Benefits

  • Onsite work location in Colorado Springs.
  • Opportunities for professional development in cybersecurity and RMF processes.
Full Job Description
Job Description

SAIC is seeking a Risk Management Framework (RMF) Analyst for an Information Systems Security Officer (ISSO) position supporting the RMF requirements of the North American Aerospace Defense Command and United States Northern Command (NORAD/USNORTHCOM) Information Technology (IT) Enterprise Services (NITES) contract. The primary work location is onsite in Colorado Springs.

Responsibilities:
  • Supporting and executing the RMF process across multiple enterprise systems and enclaves by maintaining system registrations, security baselines, and evidentiary records within the Enterprise Mission Assurance Support Service (eMASS).
  • Operating with ISSO-level ownership to independently drive continuous monitoring and Authority to Operate (ATO) sustainment, ensuring an uninterrupted and robust security posture.
  • Ensuring cybersecurity standards and operational hygiene are consistently maintained to support a Cyber Operational Readiness Assessment (CORA)-ready posture.
  • Managing the continuous cybersecurity posture of enterprise systems and identifying mitigations necessary to meet Department of Defense Directive (DoDD) 8500.01, Department of Defense Instruction (DoDI) 8510.01, DoDD 8140.01, and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 requirements.
  • Analyzing and correlating scan results from the Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP), and other approved tools to evaluate system risk, determine security posture, and maintain ATO and Assess Only authorizations.
  • Assisting with system categorization in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, including confidentiality, integrity, and availability impact levels, as information types, mission profiles, and system interconnections evolve.
  • Leading the development, maintenance, and technical validation of System Security Plans (SSPs), ensuring evidentiary artifacts accurately reflect current technical architectures and that applicable Security Technical Implementation Guides (STIGs) are implemented.
  • Exercising end-to-end ownership of Plans of Action and Milestones (POA&Ms) by systematically evaluating deficiencies, determining risk impacts, and coordinating with technical stakeholders to drive findings to timely closure.
  • Collaborating proactively with system administrators, network engineers, and leadership to remediate STIG findings, vulnerability scan results, and architectural deficiencies.
  • Providing strategic cybersecurity guidance, risk assessments, and status updates to system owners and leadership.
  • Providing weekly status reports that summarize accomplishments across assigned packages, risk posture, issues, and paths forward.
  • Creating, refining, and enforcing the operational policies, procedures, and artifacts necessary to ensure security controls are fully implemented and audit-ready.


Qualifications

Required Qualifications:
  • Certification required in accordance with DoD Manual (DoDM) 8140.03 at the Intermediate level, such as CompTIA Security+ or an equivalent certification.
  • Bachelor's degree in information assurance, cybersecurity, or a related field, plus 3-5 years of relevant experience; or a high school diploma or equivalent plus 7-10 years of relevant information assurance or cybersecurity experience.
  • At least 2 years of direct experience serving as an ISSO or cybersecurity practitioner supporting DoD systems, including:
    • Direct experience managing RMF lifecycle artifacts and end-to-end eMASS package management across multiple concurrent systems.
    • Proven experience authoring, tracking, and coordinating technical remediation to drive POA&Ms to validated completion.
  • Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.
  • Demonstrated ability to operate with a high degree of autonomy, self-direct work, and lead cross-functional technical teams through complex authorization lifecycles.

Desired Qualifications:
  • Ability to work effectively in a team-focused, dynamic, high-tempo operational environment.
  • Experience using STIG Viewer and automated compliance tools.
  • Prior experience participating in Change Advisory Boards (CABs).

About SAIC

Science Applications International Corporation (SAIC) is a technology integrator in the technical, engineering, intelligence, and enterprise information technology markets. SAIC has approximately 26,000 employees and operates in more than 70 countries. The company was founded in 1969 and is headquartered in Reston, Virginia. SAIC provides services to the U.S. government, including the Department of Defense, the intelligence community, and civilian agencies. The company also serves commercial customers in the healthcare, energy, and financial services sectors.
Learn more about SAIC
Size
26,000 employees
Market Cap
$6 billion
Industry
Information Technology
Net Income
$206 million
Founded
1969
5 Year Trend
+10.7%
Revenue
$6.8 billion
NASDAQ
SAIC
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at SAIC

More Aerospace & Defense Jobs

Find similar Risk Management Framework Analyst jobs:

NationwideColorado Springs, CO