Job Requirements
Remote Remote
Secret Polygraph Unspecified
Mid Level Career (5+ yrs experience)
Salary not specified
Join Premium to unlock estimated salaries 
Job Description
RMF Security Engineer
Full Time | Remote | Secret Clearance Required
SteelGate is seeking an RMF Security Engineer to provide end-to-end Assessment and Authorization (A&A) support for a Department of Defense cybersecurity environment. This role will support the implementation, testing, monitoring, and enforcement of cybersecurity, privacy, and financial controls in accordance with the NIST Risk Management Framework (RMF), NIST SP 800-53 controls, and applicable DoD policies.
The successful candidate will interpret security and compliance risks, recommend practical approaches to meeting federal cybersecurity requirements, and support the full RMF lifecycle from preparation and categorization through control implementation, assessment, authorization, and continuous monitoring. The role requires strong technical judgment, experience with eMASS and related A&A platforms, and the ability to work effectively with highly technical system and network administrators.
Key Responsibilities
• Provide end-to-end A&A support across all phases of the federal RMF lifecycle.
• Map, implement, interpret, and document RMF security controls in accordance with NIST SP 800-53 and DoD policy.
• Develop, maintain, and submit Authorization to Operate (ATO) packages, including a minimum of six completed ATO packages.
• Manage cybersecurity documentation and artifacts within the eMASS cybersecurity management tool.
• Support the development, maintenance, and remediation of Plans of Action and Milestones (POA&Ms).
• Conduct or support Security Tests and Evaluations (ST&E), control assessments, risk assessments, threat assessments, and authorization activities.
• Plan and monitor security control implementation for networks, enclaves, applications, and information systems.
• Support cybersecurity, privacy, and financial control implementation, testing, monitoring, and enforcement.
• Interpret identified risks and recommend mitigation strategies or compliance approaches to meet DoD requirements.
• Develop, organize, and maintain system security documentation and RMF deliverables.
• Support third-party audits and compliance reviews by preparing evidence, responding to findings, and tracking remediation activities.
• Generate and interpret ACAS scan results to identify system vulnerabilities and monitor remediation efforts or mitigation strategies.
• Implement and evaluate manual Security Technical Implementation Guides (STIGs), Security Content Automation Protocol (SCAP), and SCAP Compliance Checker (SCC) requirements.
• Use common A&A platforms, including eMASS, CSAM, Xacta, or comparable tools.
• Collaborate closely with system administrators, network administrators, application teams, and other technical stakeholders to improve overall security measures.
• Communicate security findings, risks, control deficiencies, and recommendations clearly to technical and leadership audiences.
• Ensure RMF work products are accurate, complete, organized, and aligned to client and DoD requirements.
Required Qualifications
• Minimum 5 years of experience in Risk Management Framework, cybersecurity engineering, security engineering, or a related technical discipline.
• Thorough understanding of the federal RMF Assessment and Authorization process, including all phases of the RMF lifecycle.
• Experience mapping, implementing, interpreting, and documenting RMF security controls.
• Experience developing and submitting ATO packages.
• Experience supporting POA&M management, ST&E activities, system documentation, authorization activities, risk assessments, third-party audits, NIST SP 800-53 compliance, and threat assessments.
• Proven ability to plan and monitor security control implementation for networks, enclaves, and information systems.
• Experience generating and interpreting ACAS scans to identify vulnerabilities and monitor remediation activities.
• Working knowledge and experience implementing and evaluating manual STIGs, SCAP, and SCC.
• Working knowledge of common A&A platforms, including eMASS, CSAM, Xacta, or comparable tools.
• Strong understanding of DoD cybersecurity, privacy, compliance, and risk management requirements.
• Strong written and verbal communication skills, including the ability to work effectively with highly technical administrators and other stakeholders.
• Active Secret clearance required.
• Ability to manage multiple priorities, maintain accurate security documentation, and support time-sensitive authorization milestones.
Preferred Qualifications
• Previous experience supporting Department of Defense or other federal cybersecurity programs.
• Previous experience in a technical role such as a system administrator, network administrator, security administrator, or cybersecurity engineer.
• Experience supporting continuous monitoring, control reassessment, vulnerability remediation, and authorization maintenance activities.
• Experience interpreting DoD cybersecurity policies, security guidance, and control implementation requirements.
• Experience supporting cybersecurity, privacy, and financial control environments.
• Experience with additional federal cybersecurity or A&A tools beyond eMASS, CSAM, and Xacta.
• Relevant certifications such as CISSP, CISM, Security+, CAP, or equivalent RMF and cybersecurity credentials.
• Experience coordinating across system owners, information system security managers, assessors, authorizing officials, and technical stakeholders.
Candidate Profile
The ideal candidate is a technically credible and detail-oriented RMF Security Engineer who can manage the full A&A lifecycle while translating complex cybersecurity requirements into practical implementation and remediation actions. They should have demonstrated experience building and submitting ATO packages, managing eMASS artifacts, evaluating security controls, interpreting ACAS and STIG results, and supporting POA&M closure.
The successful candidate will be comfortable operating in a federal cybersecurity environment, collaborating with system and network administrators, communicating risk clearly, and maintaining the documentation discipline required to support DoD authorization and continuous monitoring activities
Job Types: Full-Time , Remote
Salary: $120,0000 - $130,000
Schedule: Monday-Friday
• 401(k) matching
• Dental insurance
• Health insurance
• Paid time off
• Professional development assistance
• Vision insurance
STEELGATE LLC is a Service-Disabled, Veteran-Owned Small Business (SDVOSB) that prides itself in hiring top-level Subject Matter Experts (SME’s) proven to exceed deliverable expectations. STEELGATE LLC is focused on solving the hard problems facing our government and commercial clients. Our success lies in blending together relevant domain/functional knowledge with deep expertise in Information Technology, Cybersecurity, Defensive Cyber Operations, cloud-based DevSecOps, Data Analytics & AI, Acquisition and Acquisition Management, and more. STEELGATE LLC has a positive, inclusive workplace environment where all team members and partners work towards mutual success. We have established a reliable reach-back program whereas all SMEs are available to support, advise and directly complete mission deliverables when necessary. STEELGATE LLC has a worldwide reputation as a valued and trustworthy partner. Our can-do attitude and willingness to support any mission requirement sets us apart from other small business organizations. Find out more about STEELGATE LLC @ www.steelgatellc.com.
We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other characteristic protected by law.
Full Time | Remote | Secret Clearance Required
SteelGate is seeking an RMF Security Engineer to provide end-to-end Assessment and Authorization (A&A) support for a Department of Defense cybersecurity environment. This role will support the implementation, testing, monitoring, and enforcement of cybersecurity, privacy, and financial controls in accordance with the NIST Risk Management Framework (RMF), NIST SP 800-53 controls, and applicable DoD policies.
The successful candidate will interpret security and compliance risks, recommend practical approaches to meeting federal cybersecurity requirements, and support the full RMF lifecycle from preparation and categorization through control implementation, assessment, authorization, and continuous monitoring. The role requires strong technical judgment, experience with eMASS and related A&A platforms, and the ability to work effectively with highly technical system and network administrators.
Key Responsibilities
• Provide end-to-end A&A support across all phases of the federal RMF lifecycle.
• Map, implement, interpret, and document RMF security controls in accordance with NIST SP 800-53 and DoD policy.
• Develop, maintain, and submit Authorization to Operate (ATO) packages, including a minimum of six completed ATO packages.
• Manage cybersecurity documentation and artifacts within the eMASS cybersecurity management tool.
• Support the development, maintenance, and remediation of Plans of Action and Milestones (POA&Ms).
• Conduct or support Security Tests and Evaluations (ST&E), control assessments, risk assessments, threat assessments, and authorization activities.
• Plan and monitor security control implementation for networks, enclaves, applications, and information systems.
• Support cybersecurity, privacy, and financial control implementation, testing, monitoring, and enforcement.
• Interpret identified risks and recommend mitigation strategies or compliance approaches to meet DoD requirements.
• Develop, organize, and maintain system security documentation and RMF deliverables.
• Support third-party audits and compliance reviews by preparing evidence, responding to findings, and tracking remediation activities.
• Generate and interpret ACAS scan results to identify system vulnerabilities and monitor remediation efforts or mitigation strategies.
• Implement and evaluate manual Security Technical Implementation Guides (STIGs), Security Content Automation Protocol (SCAP), and SCAP Compliance Checker (SCC) requirements.
• Use common A&A platforms, including eMASS, CSAM, Xacta, or comparable tools.
• Collaborate closely with system administrators, network administrators, application teams, and other technical stakeholders to improve overall security measures.
• Communicate security findings, risks, control deficiencies, and recommendations clearly to technical and leadership audiences.
• Ensure RMF work products are accurate, complete, organized, and aligned to client and DoD requirements.
Required Qualifications
• Minimum 5 years of experience in Risk Management Framework, cybersecurity engineering, security engineering, or a related technical discipline.
• Thorough understanding of the federal RMF Assessment and Authorization process, including all phases of the RMF lifecycle.
• Experience mapping, implementing, interpreting, and documenting RMF security controls.
• Experience developing and submitting ATO packages.
• Experience supporting POA&M management, ST&E activities, system documentation, authorization activities, risk assessments, third-party audits, NIST SP 800-53 compliance, and threat assessments.
• Proven ability to plan and monitor security control implementation for networks, enclaves, and information systems.
• Experience generating and interpreting ACAS scans to identify vulnerabilities and monitor remediation activities.
• Working knowledge and experience implementing and evaluating manual STIGs, SCAP, and SCC.
• Working knowledge of common A&A platforms, including eMASS, CSAM, Xacta, or comparable tools.
• Strong understanding of DoD cybersecurity, privacy, compliance, and risk management requirements.
• Strong written and verbal communication skills, including the ability to work effectively with highly technical administrators and other stakeholders.
• Active Secret clearance required.
• Ability to manage multiple priorities, maintain accurate security documentation, and support time-sensitive authorization milestones.
Preferred Qualifications
• Previous experience supporting Department of Defense or other federal cybersecurity programs.
• Previous experience in a technical role such as a system administrator, network administrator, security administrator, or cybersecurity engineer.
• Experience supporting continuous monitoring, control reassessment, vulnerability remediation, and authorization maintenance activities.
• Experience interpreting DoD cybersecurity policies, security guidance, and control implementation requirements.
• Experience supporting cybersecurity, privacy, and financial control environments.
• Experience with additional federal cybersecurity or A&A tools beyond eMASS, CSAM, and Xacta.
• Relevant certifications such as CISSP, CISM, Security+, CAP, or equivalent RMF and cybersecurity credentials.
• Experience coordinating across system owners, information system security managers, assessors, authorizing officials, and technical stakeholders.
Candidate Profile
The ideal candidate is a technically credible and detail-oriented RMF Security Engineer who can manage the full A&A lifecycle while translating complex cybersecurity requirements into practical implementation and remediation actions. They should have demonstrated experience building and submitting ATO packages, managing eMASS artifacts, evaluating security controls, interpreting ACAS and STIG results, and supporting POA&M closure.
The successful candidate will be comfortable operating in a federal cybersecurity environment, collaborating with system and network administrators, communicating risk clearly, and maintaining the documentation discipline required to support DoD authorization and continuous monitoring activities
Job Types: Full-Time , Remote
Salary: $120,0000 - $130,000
Schedule: Monday-Friday
• 401(k) matching
• Dental insurance
• Health insurance
• Paid time off
• Professional development assistance
• Vision insurance
STEELGATE LLC is a Service-Disabled, Veteran-Owned Small Business (SDVOSB) that prides itself in hiring top-level Subject Matter Experts (SME’s) proven to exceed deliverable expectations. STEELGATE LLC is focused on solving the hard problems facing our government and commercial clients. Our success lies in blending together relevant domain/functional knowledge with deep expertise in Information Technology, Cybersecurity, Defensive Cyber Operations, cloud-based DevSecOps, Data Analytics & AI, Acquisition and Acquisition Management, and more. STEELGATE LLC has a positive, inclusive workplace environment where all team members and partners work towards mutual success. We have established a reliable reach-back program whereas all SMEs are available to support, advise and directly complete mission deliverables when necessary. STEELGATE LLC has a worldwide reputation as a valued and trustworthy partner. Our can-do attitude and willingness to support any mission requirement sets us apart from other small business organizations. Find out more about STEELGATE LLC @ www.steelgatellc.com.
We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other characteristic protected by law.
group id: 91133289
