Risk Management Framework (RMF), Security, and Authorization to Operate (ATO) Manager

Description About Our Team Our employees thrive in a culture that is fast-paced, collaborative, and ego-free, where innovation and teamwork are encouraged at every level. We provide Federal agencies with immediate access to highly skilled professionals who understand complex mission challenges and deliver efficient, scalable solutions. By continuously investing in talent, technology, and specialized capabilities, we maintain expert teams prepared to support evolving Federal missions through tailored technical solutions and modern service delivery approaches. We value diverse perspectives and strive to attract talent from all backgrounds. We are seeking professionals who are passionate about technology, mission success, and solving complex operational challenges with creativity and purpose. If you enjoy expanding your technical expertise while supporting impactful Federal initiatives, you will thrive within our organization. Veterans and military spouses are strongly encouraged to apply and bring their valuable experience to our team. About the Role We are seeking an experienced and highly motivated Risk Management Framework (RMF), Security, and Authorization to Operate (ATO) Manager to serve as the Contractor’s lead responsible for cybersecurity compliance, RMF lifecycle execution, and authorization activities supporting a mission-critical enterprise platform within the Department of Veterans Affairs (VA) environment. In this role, you will coordinate closely with the Program Manager, Technical Directors, and Government cybersecurity stakeholders (e.g., AO, ISSO, ISO) to ensure continuous compliance with Federal cybersecurity requirements and uninterrupted ATO status across all supported systems and services. The RMF, Security, and ATO Manager will oversee all cybersecurity, compliance, and authorization activities across a complex cloud-hosted platform, ensuring alignment with VA security policies, NIST RMF processes, and continuous monitoring requirements. This position requires deep expertise in Federal cybersecurity frameworks, RMF lifecycle management, and secure cloud or hybrid environments supporting healthcare systems and Protected Health Information (PHI). RESPONSIBILITIES RMF Lifecycle & ATO Management Lead all Risk Management Framework (RMF) and Authorization to Operate (ATO) activities across the platform and hosted applications. Manage the full RMF lifecycle (Categorize, Select, Implement, Assess, Authorize, Monitor) to ensure continuous compliance and no lapse in authorization status. Coordinate directly with Government stakeholders (AO, ISSO, ISO) to support authorization efforts, renewals, and significant change requests. Security Documentation & Compliance Oversee development and maintenance of all required security documentation, including System Security Plans (SSPs), POA&Ms, Security Assessment Reports, contingency plans, and authorization artifacts. Ensure all documentation remains accurate, current, and aligned with system architecture, operations, and control implementations. Ensure compliance with Federal and healthcare security requirements, including NIST SP 800-53, FISMA, HIPAA, and VA cybersecurity policies. Continuous Monitoring & Risk Management Lead continuous monitoring (CONMON) activities, including vulnerability scanning, remediation tracking, and compliance reporting. Manage POA&M lifecycle, ensuring timely updates, mitigation tracking, and closure of findings. Identify, track, and mitigate cybersecurity risks impacting system authorization and operational readiness. Ensure vulnerabilities are prioritized and resolved within required timelines and escalate high-risk issues as needed. Security Integration & Operations Coordinate with engineering, DevSecOps, and operations teams to ensure security controls are implemented and validated across cloud and application environments. Support integration of security practices into CI/CD pipelines, including automated testing (SAST, DAST, container scanning, IaC validation). Support incident response activities from a security perspective, ensuring proper documentation, root cause analysis, and corrective actions. Audit, Reporting & Stakeholder Engagement Lead preparation for security audits, assessments, and compliance reviews, including tracking and remediation of findings. Provide regular reporting to VA stakeholders on ATO status, system security posture, risk exposure, and remediation progress. Serve as the primary cybersecurity liaison, ensuring clear communication between the delivery team and Government leadership. TAG: #LI-I4DM TAG: INDMJC Requirements QUALIFICATIONS Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field. 7+ years of experience in cybersecurity, information assurance, or RMF/ATO management roles supporting Federal or mission-critical application environments. Strong expertise in NIST SP 800-53 controls, RMF lifecycle processes, and Federal cybersecurity compliance frameworks (FISMA, NIST, OMB). Demonstrated experience managing ATO processes, continuous monitoring programs, and security compliance for cloud or hybrid environments. Experience supporting enterprise platforms and applications, including containerized or cloud-native architectures. Active CISSP, CISM, or equivalent advanced cybersecurity certification. Experience managing vulnerability management programs, POA&M tracking, and security mitigation strategies. Strong understanding of incident response, contingency planning, and system recovery processes. Excellent communication and stakeholder management skills, with the ability to interface with Government security leadership. Experience supporting RMF/ATO activities within VA or similar environments, with awareness of tools like eMASS and SNOWCAM and related governance practices. Understanding of federal/VA cybersecurity guidelines, including Directive 6500, TRM compliance concepts, and Zero Trust frameworks. Candidates must be eligible to obtain and maintain a Public Trust clearance. PREFERRED QUALIFICATIONS Experience supporting AWS GovCloud or similar Federal cloud environments, including containerized platforms (e.g., Kubernetes/EKS). Experience managing cybersecurity for systems handling Protected Health Information (PHI), including HIPAA and Business Associate Agreement (BAA) compliance. Familiarity with continuous monitoring (CONMON), vulnerability scanning tools (e.g., Nessus), and Federal reporting requirements. Experience supporting large-scale Federal programs with complex, multi-system authorization boundaries. Experience aligning DevSecOps pipelines with RMF requirements, including automated security testing and compliance validation.