RMF Assessment & Quality Assurance Lead (R-00189)
True Zero Technologies · full-time · posted 6 Aug
You came here asking one thing. Salary?
$$$ → ???
They didn't say.
*It says “competitive,” which is a word, not a number.
Second question — can you apply from where you sit?
Open to U.S.
Compare it with where you sit.
→ inferred locally from your browser clock. nothing is stored.
The actual job
RMF Assessment & Quality Assurance Lead (R-00189)
True Zero Technologies
- Seniority
- Lead
- Engagement
- Full-time
- Posted
- 3 days ago
What the posting asks for
- 5 years of experience
- NIST RMF
- NIST SP 800-37
- NIST SP 800-53 Rev. 5
- NIST SP 800-53A
Employer text
The posting, in its own words
True Zero is seeking an RMF Assessment & Quality Assurance Lead to ensure the quality, completeness, and readiness of authorization packages supporting enterprise cybersecurity operations at the National Institutes of Health (NIH). This position serves as the primary quality assurance authority for RMF activities, ensuring security documentation, assessment evidence, and authorization artifacts are complete, internally consistent, and ready for Government review and independent assessment.
Working closely with RMF analysts, ISSOs, vulnerability management personnel, and system owners, the RMF Assessment & Quality Assurance Lead establishes quality standards across the authorization lifecycle while coordinating assessment readiness activities, validating supporting evidence, and reducing rework before formal reviews. This role plays a critical part in maintaining continuous authorization readiness while supporting ongoing monitoring and enterprise cybersecurity governance.
Job Responsibilities
- Lead quality assurance activities supporting the full Risk Management Framework (RMF) lifecycle.
- Review System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), control implementations, and supporting authorization documentation for quality, completeness, and consistency.
- Validate assessment evidence to ensure security controls are properly documented and supported prior to Government or independent assessor review.
- Coordinate assessment readiness activities across RMF analysts, ISSOs, system owners, security engineers, and technical stakeholders.
- Develop and maintain quality review checklists, documentation standards, and authorization package review procedures.
- Identify documentation deficiencies, control implementation gaps, and process improvement opportunities before formal assessments.
- Support coordination with independent assessors during Security Control Assessments (SCAs), annual assessments, and authorization activities.
- Verify that remediation activities, POA&M updates, and corrective actions are accurately reflected within authorization packages.
- Track assessment readiness metrics and recommend process improvements that improve authorization quality and reduce package rework.
- Support continuous monitoring by validating ongoing updates to authorization documentation and security evidence.
- Mentor RMF analysts and ISSOs on documentation quality, evidence standards, and authorization best practices.
- Maintain separation of duties by ensuring personnel supporting package development remain independent from formal assessment activities where required.
Job Qualifications
- Bachelor’s degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related discipline.
- Five or more years of experience supporting Federal RMF, Assessment and Authorization (A&A), or cybersecurity governance programs.
- Demonstrated experience reviewing authorization packages for quality, completeness, and compliance with Federal cybersecurity requirements.
- Strong knowledge of NIST RMF, NIST SP 800-37, NIST SP 800-53 Rev. 5, NIST SP 800-53A, and FISMA.
- Experience supporting Security Control Assessments (SCAs), annual assessments, continuous monitoring, and ongoing authorization.
- Experience coordinating with ISSOs, System Owners, Security Control Assessors, and Authorizing Officials.
- Excellent analytical, organizational, technical writing, and communication skills.
- Experience supporting NIH, HHS, or other Federal civilian agencies.
- Experience using JCAM, eMASS, ServiceNow GRC, or comparable governance and compliance platforms.
- Experience supporting High Value Assets (HVAs), cloud authorizations, or enterprise RMF programs.
- Familiarity with FedRAMP, common control inheritance, continuous monitoring, and Federal audit support.
- Experience developing authorization quality standards, review checklists, and documentation templates.
One or more of the following is preferred:
- Certified in Governance, Risk and Compliance (CGRC)
- CISSP
- CAP (Certified Authorization Professional)
- CISM
- Security+
- PMP
Onward
More Software Engineering and Development Leadership roles with overlapping applicant locations
Lead Engineer, AI Attack Simulation
about 11 hours agoTypeScript · Python · Java
10 years of experience, AI-first product development, Cybersecurity product experience, Go, Distributed systems, Agentic systems, Mentoring engineers, Product strategy collaboration, Adversarial AI techniques, Tool orchestration, Breach and attack simulation
Director of Engineering
about 11 hours ago10 years of experience, Agentic AI transition, Cloud technologies, Software development, Systems architecture, Leading multiple engineering teams, Driving technical innovation, Agile methodologies, Continuous integration, DevOps practices, Strategic planning, Performance metrics
Software Architect
about 11 hours agoTypeScript · Next.js · Python
Azure, Typescript, Python, AI frameworks, Secure systems design, Scalable systems design, Leadership, Problem-solving, Ownership, Adaptability
