Qualifications

• Bachelor's degree and 4+ years of Risk Management Framework (RMF) or Authorization and Accreditation (A&A) experience in a federal environment.
• Proficient in NIST SP 800-37 Rev 2, 800-53 Rev 5, 800-53A, and FISMA compliance standards.
• Hands-on experience in Plan of Action & Milestones (POA&M) management and familiarity with CSAM or comparable Governance, Risk, and Compliance (GRC) tools.
• Possess Security+ or CAP/CGRC certification for validation of security expertise.
• Must have a current T2 (background investigation) or higher, acceptable through reciprocity.

Responsibilities

• Map NIH's FISMA systems to Zero Trust controls and document inherited, hybrid, and uncovered controls for remediation.
• Analyze residual gaps based on FIPS 199 impact, data sensitivity, and internet exposure.
• Support the project management phases for the Task 4 pipeline, including time analysis and documentation workflows.
• Create mappings and evidence expectations for Zero Trust Architecture (ZTA) overlays and participate in three-system pilot.
• Maintain an updated shared control library for NIH's ZTA initiatives.
• Develop templates for necessary documentation (SSP, SAP/SAR, POA&M) and monitoring processes as per SP 800-137.
• Manage content updates on the OCIO ZTA Wiki and serve as a point of contact for ZTA-related inquiries.

Benefits

• Hybrid work environment with on-site requirements primarily in Bethesda, MD.
• Opportunity to work within the prestigious NIH and contribute to federal cybersecurity initiatives.
• Engagement in cutting-edge projects related to Zero Trust Architecture and Risk Management.
• Access to continuous professional development through certifications and training.
• Collaboration with experienced professionals in the field of information security and compliance.