RMF Instructor- Security Control Implementation Statements

Cybervance is a rapidly growing information security and information technology company based in Washington, D.C. We are an equal opportunity employer.

Cybervance combines advanced cybersecurity expertise with proven federal contracting experience to deliver innovated, mission-focused solutions for U.S. Government agencies. We are committed to helping our partners achieve measurable improvements in security and resilience.

Cybervance is seeking skilled instructors to deliver live virtual training for ISSOs, system owners, and security managers working on cloud, hybrid, and FedRAMP systems. We are looking first for a strong, engaging instructor, backed by practitioner-level RMF expertise and instructional design skills to build and refine course content.

The program includes an RMF course covering boundary definition, categorization, control allocation, assessment, authorization, and continuous monitoring, plus three control-family courses: Identity and Access (AC, IA, PS); Detection, Response, and Recovery (AU, CA, CP); and Secure Configuration and Vulnerability Management (CM, SI, SA, SC). All courses focus on writing high-quality security control implementation statements, using a standardized cycle: Gather, Write, Verify. Each course runs one day and is offered multiple times annually.

Deliver engaging, hands-on live virtual labs and Essentials sessions, adapting pace and depth for audiences ranging from new ISSOs and managers to experienced practitioners.
• Facilitate mock interviews with role-players such as system owners, IT staff, auditors, and assessors, coach students through each Gather, Write, Verify cycle, and give specific, actionable feedback on their drafts.
• Teach boundary definition for systems with cloud and SaaS components, using Common Criteria concepts and FedRAMP guidance, and control allocation across common control providers, cloud providers, and the system.
• Teach students to write statements that name the boundary components each part covers, show how the control is allocated (inherited, hybrid, or system-specific), and fill in organization-defined parameters such as who, how fast, and how often.
• Run verification exercises against simulated configurations, scans, logs, and account listings using NIST SP 800-53A methods (examine, interview, test).