Security Authorization Lead (RMF and ATO) Jobs

Summary

Job Title

SECURITY COMPLIANCE | ACTIVE SECRET CLEARANCE REQUIRED, TS/SCI PREFERRED | U.S. CITIZENSHIP REQUIRED | REMOTE OR HYBRID (CONUS)

Job Description

An Authority to Operate is won or lost long before the package reaches the Authorizing Official. It is won in how the control narratives are written, how the evidence is gathered, and how honestly the residual risk is described. This seat owns that work end to end, from the first System Security Plan draft through sustained continuous monitoring after the signature. You will need to be bilingual. Engineers will tell you what they built, and you will have to translate it into control language that an assessor accepts; assessors will hand back findings, and you will have to translate those into engineering work that actually closes the gap. Compliance professionals who can only do one half of that translation struggle in this role.

WHAT YOU WILL DO

• Author the package. Write and maintain System Security Plans, control implementation statements, and the supporting artifacts an assessor will actually read.
• Own the POA&M lifecycle. Open, prioritize, track, and close Plans of Action and Milestones, with realistic milestones and evidence that stands up to review.
• Drive the ATO to signature. Manage the accreditation timeline, coordinate assessment activities, prepare risk acceptance narratives, and brief the ISSM and Authorizing Official.
• Work the tooling. Maintain the package in eMASS or XACTA, keeping control status, artifacts, and assessment procedures linked and current.
• Translate scan output into action. Review ACAS, STIG, and cloud configuration findings, then work with engineers to remediate rather than simply reporting the count.
• Sustain continuous monitoring. Run the recurring control assessments, configuration change reviews, and reporting cadence that keep an ATO from decaying quietly.
• Advise early. Get into architecture conversations before the build is finished, so controls are designed in rather than retrofitted.

Required Qualifications

Active Secret clearance or higher. U.S. citizenship. Demonstrated ownership of at least one system through a full ATO, from documentation through authorization decision. Hands-on authorship of System Security Plans and control implementation statements, not just review of documents written by others. Working proficiency in eMASS or XACTA. Command of NIST SP 800-53 and the Risk Management Framework lifecycle. POA&M management experience, including milestone development, evidence collection, and closure. Ability to communicate clearly with engineers, ISSOs, ISSMs, and Authorizing Officials.

Preferred Qualifications

Cloud accreditation experience, particularly AWS or AWS GovCloud. Familiarity with the DoD Cloud Computing Security Requirements Guide at IL4, IL5, or IL6, and with CNSSI 1253 categorization. DISA STIG and ACAS experience. CISSP, CISM, CAP, or CGRC certification. Prior ISSO or ISSM appointment on a Federal or Department of Defense system. Experience with compliance as code, where control evidence is generated by automation rather than assembled by hand.

Working Environment

The seat is remote or hybrid within the continental United States, with periodic on-site presence for assessment and accreditation activities depending on the supported program. This role pairs with a Cloud Security Guardrails Engineer, who owns the technical enforcement layer. The split is deliberate: authorization depth and hands-on policy engineering are different skills, and asking one person to do both tends to shortchange whichever half they enjoy less.

About D9Tech Resources

D9Tech Resources is a Service-Disabled Veteran-Owned Small Business and SBA 8(a) participant delivering cleared cloud, cybersecurity, network, data, and AI engineering to Federal and Department of Defense customers.

How To Apply

Submit your resume to [email protected] with the position title in the subject line. Applicants selected for screening will be contacted directly to verify clearance status before any interview is scheduled.

Job Description

Job Title

SECURITY COMPLIANCE | ACTIVE SECRET CLEARANCE REQUIRED, TS/SCI PREFERRED | U.S. CITIZENSHIP REQUIRED | REMOTE OR HYBRID (CONUS)

Job Description

An Authority to Operate is won or lost long before the package reaches the Authorizing Official. It is won in how the control narratives are written, how the evidence is gathered, and how honestly the residual risk is described. This seat owns that work end to end, from the first System Security Plan draft through sustained continuous monitoring after the signature. You will need to be bilingual. Engineers will tell you what they built, and you will have to translate it into control language that an assessor accepts; assessors will hand back findings, and you will have to translate those into engineering work that actually closes the gap. Compliance professionals who can only do one half of that translation struggle in this role.

WHAT YOU WILL DO

• Author the package. Write and maintain System Security Plans, control implementation statements, and the supporting artifacts an assessor will actually read.
• Own the POA&M lifecycle. Open, prioritize, track, and close Plans of Action and Milestones, with realistic milestones and evidence that stands up to review.
• Drive the ATO to signature. Manage the accreditation timeline, coordinate assessment activities, prepare risk acceptance narratives, and brief the ISSM and Authorizing Official.
• Work the tooling. Maintain the package in eMASS or XACTA, keeping control status, artifacts, and assessment procedures linked and current.
• Translate scan output into action. Review ACAS, STIG, and cloud configuration findings, then work with engineers to remediate rather than simply reporting the count.
• Sustain continuous monitoring. Run the recurring control assessments, configuration change reviews, and reporting cadence that keep an ATO from decaying quietly.
• Advise early. Get into architecture conversations before the build is finished, so controls are designed in rather than retrofitted.

Required Qualifications

Active Secret clearance or higher. U.S. citizenship. Demonstrated ownership of at least one system through a full ATO, from documentation through authorization decision. Hands-on authorship of System Security Plans and control implementation statements, not just review of documents written by others. Working proficiency in eMASS or XACTA. Command of NIST SP 800-53 and the Risk Management Framework lifecycle. POA&M management experience, including milestone development, evidence collection, and closure. Ability to communicate clearly with engineers, ISSOs, ISSMs, and Authorizing Officials.

Preferred Qualifications

Cloud accreditation experience, particularly AWS or AWS GovCloud. Familiarity with the DoD Cloud Computing Security Requirements Guide at IL4, IL5, or IL6, and with CNSSI 1253 categorization. DISA STIG and ACAS experience. CISSP, CISM, CAP, or CGRC certification. Prior ISSO or ISSM appointment on a Federal or Department of Defense system. Experience with compliance as code, where control evidence is generated by automation rather than assembled by hand.

Working Environment

The seat is remote or hybrid within the continental United States, with periodic on-site presence for assessment and accreditation activities depending on the supported program. This role pairs with a Cloud Security Guardrails Engineer, who owns the technical enforcement layer. The split is deliberate: authorization depth and hands-on policy engineering are different skills, and asking one person to do both tends to shortchange whichever half they enjoy less.

About D9Tech Resources

D9Tech Resources is a Service-Disabled Veteran-Owned Small Business and SBA 8(a) participant delivering cleared cloud, cybersecurity, network, data, and AI engineering to Federal and Department of Defense customers.

How To Apply

Submit your resume to [email protected] with the position title in the subject line. Applicants selected for screening will be contacted directly to verify clearance status before any interview is scheduled.