RMF / CSAM Analyst

Pingwind

United States

Remote

Who this role is best for

Aimed at mid-level cybersecurity professionals who specialize in federal compliance and risk management, working remotely with a focus on documentation and collaboration across teams.

Best fit for

Mid-level professionals with federal compliance and risk management experience, particularly in RMF and CSAM.
— “RMF / CSAM Analyst is responsible for ensuring the FSA IAM system maintains continuous security authorization and compliance through the Risk Management Framework (RMF) and the Cyber Security Assessment and Management (CSAM) tool.”
Candidates with a background in managing security controls, POA&M items, and federal reporting frameworks.
— “track and remediate Plan of Action and Milestones (POA&M) items, support FISMA reporting and corrective action plans.”
Individuals who can balance routine compliance tasks with urgent security issues and maintain detailed documentation.
— “Ability to work effectively on both routine compliance tasks and urgent security issues.”

Things to consider

This role requires maintaining high cybersecurity standards in a federal environment, which may involve strict adherence to policies.
— “Commitment to maintaining high cybersecurity standards in a federal environment”
The role demands a strong understanding of federal cybersecurity policies and compliance requirements, which may require ongoing education.
— “Good understanding of federal cybersecurity policies and compliance requirements”

How to stand out

Highlight specific experience with FedRAMP, FISMA, and POA&M management in your resume and interview responses.
— “Experience with FedRAMP, FISMA, POA&M management, and security control inheritance”
Emphasize your ability to manage encryption standards and compliance tracking systems effectively.
— “manage proper encryption of data at rest (AES-256 with SHA-256) and data in transit (latest TLS protocols)”
Showcase your experience with maintaining environment support documentation and security incident management.
— “maintains environment support documentation, and handles key user data encryption and protection requirements”
Demonstrate familiarity with federal records, CUI handling, and Section 508 compliance in your application.
— “supporting supply chain risk management, federal records and Controlled Unclassified Information (CUI) handling, IT accessibility (Section 508)”

Pace · SteadyCollaboration · MediumAutonomy · MediumDecision Impact · TeamLevel · Mid

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

Maintaining continuous security authorization and compliance
Supporting the secure operation of cloud-based IAM solutions
Meeting federal standards for identity services

Typical background

Experience in federal cybersecurity policies and compliance requirementsStrong knowledge of NIST Risk Management Framework (RMF) and CSAM tool

Skills & requirements

Required

Risk Management Framework (rmf)Cyber Security Assessment And Management (csam) ToolFedrampFismaPoa&m ManagementSecurity Control InheritanceNIST SP 800-63OMB M-21-31Cloud Security RequirementsData EncryptionLoggingCompliance ReportingMicrosoft Office ToolsCompliance Tracking Systems

Preferred

Public Trust Clearance

Stack & domain

NIST Risk Management Framework (rmf)CSAM ToolFedrampFismaPoa&m ManagementSecurity Control InheritanceNIST SP 800-63OMB M-21-31Cloud Security RequirementsMicrosoft Office ToolsCompliance Tracking SystemsCommunicationCollaborationDocumentationOrganizationAttention To DetailTeam PlayerCybersecurityIT InfrastructureSupply Chain ManagementSystem DesignContinuous Improvement

About the role

Original posting from Pingwind via Lever

Location: Remote
Required Clearance: Public Trust
Required Education: Bachelors Degree
Required Experience: 2 years
Position Description
The RMF / CSAM Analyst is responsible for ensuring the FSA IAM system maintains continuous security authorization and compliance through the Risk Management Framework (RMF) and the Cyber Security Assessment and Management (CSAM) tool. This role supports the secure operation of the new cloud-based IAM solution while meeting all federal standards for identity services.
Responsibilities
The RMF / CSAM Analyst ensures the IAM solution complies with FedRAMP requirements, OMB M-24-15 guidance, and NIST SP 800-63 Digital Identity Guidelines. They manage event logging to meet OMB M-21-31 standards and oversee proper encryption of data at rest (AES-256 with SHA-256) and data in transit (latest TLS protocols). The analyst supports Security Incident Management, maintains environment support documentation, and handles key user data encryption and protection requirements. In CSAM, they manage security controls and inheritance statements, track and remediate Plan of Action and Milestones (POA&M) items, support FISMA reporting and corrective action plans, address Continuous Diagnostics and Monitoring (CDM) findings, handle Common Vulnerabilities and Exposures (CVE) responses, and maintain the Cybersecurity Framework (CSF) scorecard at the required level or higher. Additional responsibilities include supporting supply chain risk management, data planning, federal records and Controlled Unclassified Information (CUI) handling, IT accessibility (Section 508), technology business management reporting, and project, risk, and schedule documentation needed to sustain the Authority to Operate (ATO).
Required Qualifications
Strong knowledge of NIST Risk Management Framework (RMF) and CSAM tool
Experience with FedRAMP, FISMA, POA&M management, and security control inheritance
Familiarity with NIST SP 800-63, OMB M-21-31, and cloud security requirements
Ability to analyze scan results, develop corrective action plans, and track remediation
Excellent documentation, organization, and attention to detail skills
Clear communication and collaboration with ISSOs, security teams, and stakeholders
Understanding of data encryption, logging, and compliance reporting
Proficiency with Microsoft Office tools and compliance tracking systems
Ability to work effectively on both routine compliance tasks and urgent security issues
Commitment to maintaining high cybersecurity standards in a federal environment
Detail-oriented with excellent documentation and tracking skills
Good understanding of federal cybersecurity policies and compliance requirements
Team player capable of supporting both routine compliance and urgent security tasks
About PingWind
PingWind is focused on delivering outstanding services to the federal government. We have extensive experience in the fields of cybersecurity, development, IT infrastructure, supply chain management and other professional services such as system design and continuous improvement. PingWind is an SBA certified Service-Disabled Veteran-Owned Small Business (SDVOSB) with offices in Northern Virginia and Huntsville AL.
www.PingWind.com
Our benefits include:
· Eleven Federal Holidays
· Paid Time Off accrued each pay period
· Parental Leave
· Three medical plan choices with generous employer contribution
· Dental and Vision Insurance
· Company paid Short-Term and Long-Term Disability
· Company paid Life and AD&D Insurance
· 401k with competitive matching and vesting schedule
· Continuing education assistance
· Short Term / Long Term Disability & Life Insurance
· Medical, Dependent Care and Commuter Flexible Spending Accounts
· Employee Assistance Program
· Wellness benefits include Calm Health app and WellHub gym subsidy (formerly GymPass)
· 529 College Savings Plan
· Legal Insurance
· Pet Insurance
Salary Range
$75k-$104K
The pay range for this job is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) job responsibilities, education, certifications, experience, as well as internal equity mapping and alignment with market data, or other applicable laws.
Veterans are encouraged to apply
PingWind, Inc. does not discriminate in employment opportunities, terms, and conditions of employment, or practices on the basis of race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, or any characteristic protected by law.

Source: Pingwind careers (Lever)