ISSO / RMF Analyst

Empower AI is AI for government. Empower AI gives federal agency leaders the tools to elevate the potential of their workforce with a direct path for meaningful transformation. Headquartered in Reston, Va., Empower AI leverages three decades of experience solving complex challenges in Health, Defense, and Civilian missions. Our proven Empower AI Platform® provides a practical, sustainable path for clients to achieve transformation that is true to who they are, what they do, how they work, with the resources they have. The result is a government workforce that is exponentially more creative and productive. For more information, visit www.Empower.ai.

Empower AI is proud to be recognized as a 2024 Military Friendly Employer by Viqtory, the publisher of G.I. Jobs. This designation reflects the company’s commitment to hiring and supporting active-duty and veteran employees.

This position will support our newly awarded DCSA contract.

Empower AI is seeking an ISSO / RMF Analyst to support Risk Management Framework (RMF) activities for the systems and assets managed by an enterprise IT Customer Support Services program supporting a Department of War agency. Acting on behalf of the Government System Owner, the ISSO develops and maintains complete, accurate, and timely RMF documentation packages in eMASS, executes continuous monitoring, manages Plans of Action and Milestones, and keeps in-scope systems (endpoint infrastructure, printers, communications, dashboards, and support platforms) reaccredited before their ATO expiration. The role works daily with systems administrators, engineers, and the Risk Management Support Lead to translate technical configurations into compliant security controls and audit-ready evidence. This is a salaried, FLSA-exempt position in which you will independently analyze situations, determine the appropriate course of action, and exercise discretion and independent judgment on matters of significance to the program and its customers. 

• Develop, compile, update, and maintain RMF package artifacts for assigned systems in eMASS, including the System Security Plan (SSP), Security Assessment Report (SAR) inputs, Plan of Action & Milestones (POA&M), control implementation statements, and supporting artifacts required by DoDI 8510.01 and agency A&A process documentation. 

• Execute the continuous monitoring strategy for assigned systems: analyze weekly ACAS vulnerability scan results, track STIG compliance, validate remediation, and manage POA&M items to maintain security posture between authorization cycles. 

• Prepare the weekly Vulnerability Scan Analysis Report and the monthly STIG Compliance Report for assigned systems, identifying critical vulnerabilities and their remediation status. 

• Work with systems administrators, telecommunications engineers, and endpoint engineers to select, implement, and document NIST SP 800-53 security controls, verify STIG/SRG baseline configurations, and collect implementation evidence. 

• Track ATO expiration dates and drive reaccreditation activities so that every in-scope system is reauthorized prior to its 3-year ATO expiration and 100% of complete packages are delivered on the required timeline. 

• Support security control assessments and audits: prepare systems and documentation, participate in technical exchange meetings with assessors, respond to findings, and maintain a state of continuous audit readiness. 

• Review and process change requests for security impact (CM-4), support incident handling and reporting procedures, and ensure security requirements are addressed in Change Management for in-scope systems. 

• Maintain RMF process documentation, SOPs, and status trackers; provide RMF and compliance posture inputs to the Monthly Customer Support Activity Report; and mentor technicians on secure configuration and evidence collection practices. 

• CAP/CGRC, Security+ CE, CISSP Associate, or CISM certification (IAM Level II is a plus). 

• Experience with enterprise technologies commonly in scope, including Windows Server, Active Directory, VMware virtualization, Linux (RHEL), enterprise endpoint management, VoIP/VTC, and network printers. 

• Experience supporting Department of War (DoW), DoD, or Intelligence Community systems across NIPRNet, SIPRNet, and JWICS enclaves. 

• Familiarity with DoD Zero Trust, DoDI 8500.01, DoDI 8531.01 vulnerability management, and CJCSM 6510.01B incident handling. 

• Experience supporting Supply Chain Risk Management (SCRM) controls and plans. 

• Experience using ServiceNow (incident, request, knowledge, CMDB, Service Catalog, Virtual Agent) or a comparable enterprise ITSM platform. 

All hiring and promotion decisions at Empower AI are based on merit to bring the best talent available to contribute to our firm’s overall success. It is the policy of Empower AI not to discriminate against any applicant for employment, or employee because of age, color, sex, disability, national origin, race, religion, or veteran status. Empower AI is a VEVRAA Federal Contractor.

If hired for this position, the base salary range would be within the range provided. The base salary range represents the anticipated low and high end of the salary range for this position. Actual salaries may vary based on various factors including but not limited to work location, skills, experience, gov con contractual requirements, and performance. The range listed is just one component of Empower AI's total compensation package for employees.