Senior Security Risk Management Framework Engineer

LTS, United States - Remote

The role

Location: Remote (U.S.) Clearance: U.S. Citizen or Permanent Resident Required with the ability to obtain a Public Trust Salary Range: 110K – 125K

LTS is seeking a Senior Security RMF Engineer to join a cybersecurity transformation surge team supporting the VA.gov Platform. This role will serve as the bridge between VA security/RMF requirements and the engineers responsible for implementing those requirements across VA.gov.

The Senior Security / RMF Engineer must understand how security controls are implemented in modern cloud infrastructure and software delivery environments and be able to translate control deficiencies, authorization requirements, and security risks into actionable engineering work.This is not intended to be a documentation-only compliance role.

All jobs

Senior Security Risk Management Framework Engineer

LTS, United States - Remote

The role

Location: Remote (U.S.) Clearance: U.S. Citizen or Permanent Resident Required with the ability to obtain a Public Trust Salary Range: 110K – 125K

What you will do

Assess VA.gov Platform compliance with the 18 Critical Controls identified by VA and help establish a baseline of current implementation and remaining gaps.
Perform security reviews, gap analyses, and risk assessments across VA.gov Platform infrastructure, pipelines, applications, and component systems.
Support ongoing ATO and cATO readiness for the VA.gov Platform authorization boundary.
Develop, update, and maintain RMF and authorization artifacts, including System Security Plans (SSPs), control narratives, POA&Ms, Business Impact Analyses (BIAs), Privacy Threshold Analyses (PTAs), and supporting evidence.
Evaluate identified control deficiencies and work with DevSecOps engineers to translate them into prioritized technical remediation work.
Validate completed engineering remediation against applicable security-control requirements and update supporting authorization documentation and evidence.
Support implementation of OSCAL-based, machine-readable security control models and automated evidence collection.
Develop and maintain POA&M processes and support automation of the POA&M lifecycle where feasible.
Conduct and support threat modeling, secure-design reviews, and security risk assessments.
Develop, coordinate, and maintain Memorandums of Understanding (MOUs) and Interconnection Security Agreements (ISAs) as required.
Coordinate with VA security stakeholders, AODRs/AOs, OIS, CSOC, auditors, and other authorization stakeholders.
Provide security guidance and consultation to VA.gov Platform and product teams.
Help develop security guidance, standards, decision trees, and training that allow product teams to better understand and own their security responsibilities.
Support security incident response, post-incident analysis, and identification of resulting security/control remediation.
Participate in an on-call rotation for critical security events as required.
Ensure ATO documentation and supporting evidence remain synchronized with technical changes implemented by the engineering team.
The PWS specifically requires the team to determine current compliance with VA's Critical Controls, collaborate with the team managing the existing ATO, and ensure authorization documentation is updated as technical work is completed.

Senior Security Risk Management Framework Engineer

The role

Senior Security Risk Management Framework Engineer

The role

What you will do

What you need

Nice to have

Pay and benefits

Similar jobs at other companies

Information System Security Engineer

Principal Security Engineer

Cybersecurity Engineer (Clearance Required)

Cybersecurity Engineer / RMF Specialist

Senior Cyber Security Engineer (Job 1480)

RMF Security SME

LTS

Compared with similar jobs