Risk Management Framework Specialist 4

Risk Management Framework Specialist 4

Senior Level | Location: Kirtland AFB, NM | Salary: $120,000 - $166,000 | Active Top Secret/SCI or DOE Q Clearance Required

Caribou Thunder is seeking an experienced Cybersecurity Engineer 4 to support critical national security missions by strengthening the cybersecurity compliance, resilience, and authorization posture of complex Department of Defense information systems. In this role, you will lead systems through the RMF lifecycle, advise mission partners on cybersecurity risks, and help integrate security requirements into system architectures and operational environments. The ideal candidate brings extensive RMF and Assessment & Authorization experience, a strong understanding of NIST SP 800-53 Rev. 5 and DoD cybersecurity guidance, and the ability to translate security policy into practical, mission-focused solutions.

A Day in the Life - What You'll Do

• Lead information systems through the complete Risk Management Framework lifecycle, including categorization, control selection, implementation, assessment, authorization, and continuous monitoring.
  
• Serve as a trusted cybersecurity advisor to system owners, engineering teams, and mission partners, translating policy and compliance requirements into actionable technical solutions.
  
• Evaluate system security posture by reviewing risk assessments, vulnerability findings, security test results, and control implementation evidence.
  
• Recommend risk mitigation strategies involving system configuration changes, security tool updates, vulnerability remediation, and process improvements.
  
• Interpret, implement, and document security controls across networks, enclaves, and complex information systems in accordance with NIST SP 800-53 Rev. 5 and applicable DoD guidance.
  
• Develop, maintain, and manage RMF authorization packages within eMASS, ensuring security documentation remains accurate, complete, and audit-ready.
  
• Support ACAS vulnerability identification, analyze findings, and coordinate remediation and mitigation activities through POA&M development and maintenance.
  
• Integrate Zero Trust principles into RMF packages, security control implementations, and system architectures.
  
• Support continuous monitoring, security testing, log review, and detection activities to identify emerging risks and maintain authorization readiness.
  
• Partner with system engineers, developers, cybersecurity teams, and leadership to integrate security requirements throughout the system lifecycle.
  
• Evaluate enterprise-level security risks, communicate findings, and provide recommendations that support long-term compliance and mission assurance.

Required Qualifications

• Bachelor's degree in a STEM field and 9+ years of relevant professional experience, or 4 additional years of relevant experience in lieu of a degree.
  
• Active Top Secret or DOE Q clearance with SCI eligibility; must be SCI-eligible within the first 3 months of employment.
  
• 5+ years of experience supporting Risk Management Framework activities, including system categorization, security control implementation, assessment, and continuous monitoring.
  
• Demonstrated experience supporting Assessment & Authorization (A&A) activities, including POA&M maintenance, evidence collection, and security documentation development.
  
• Experience implementing and assessing cybersecurity controls in accordance with NIST SP 800-53 Rev. 5 or DoD-specific cybersecurity frameworks.
  
• Experience integrating Zero Trust principles into RMF authorization packages and system architectures.
  
• At least one of the following certifications:
  
  • CompTIA CASP+
    
  • CompTIA Security+
    
  • Systems Security Certified Practitioner (SSCP)

Preferred Qualifications

• Experience conducting security engineering analyses and advising system owners on cybersecurity risks, operational impacts, and mitigation strategies.
  
• Familiarity with integrating RMF workflows into DevSecOps or Agile development environments.
  
• Experience supporting sprint-based compliance activities and automated security monitoring processes.
  
• Experience conducting enterprise-level cybersecurity risk assessments and documenting technical findings.
  
• Ability to communicate complex cybersecurity risks and compliance issues to technical teams, system owners, and senior leadership.
  
• Experience developing long-term security strategies that improve system resilience, authorization readiness, and continuous compliance.
  
  Who is Caribou Thunder?
  
  Caribou Thunder is a HUBZone-certified small business providing advanced technical and engineering services to the U.S. Department of War and its mission partners. 35+ states and 20+ countries. We've delivered trusted solutions for over two decades - strengthening national readiness across missions on land, undersea, in the air, and throughout LEO, MEO, GEO, and deep space.
  
  Why Caribou Thunder?
  
  TEAM THUNDER - Mission Focused. Delivery Proven. Ready to Serve.
  
  Employee Advocacy Mission Proven Global Reach Skilled Teams Modern Tools Empowering Culture
  
  Our engineers and innovators ensure capability from sea floor to space frontier - delivering on time, maintaining compliance, and performing with precision in high-consequence environments.
  
  We specialize in Engineering Services, Cybersecurity, Software Development, Modeling & Simulation, Digital Engineering, and Artificial Intelligence - disciplines powering the nation's most complex technical missions.
  
  Employee Advocacy + Benefits
  
  Our people are the heart of Caribou Thunder. We invest in their growth, flexibility, and well-being - knowing their success drives ours.
  
• Premium Health, Dental & Vision Insurance
  
• 401(k) with 6% Company Match
  
• Flexible PTO & Work Schedule
  
• Your future, your flexibility, your well-being - we invest in you.
  
  Apply and let's connect.
  
• Education & Certification Reimbursement
  
• Support for Military Leave
  
• Work-Life Balance & Traditional Family Values