RMF Process Lead (R-00177)

Job Description

True Zero Technologies, a veteran-owned small business, was founded on the principle that the purposeful enablement of people and technology in an organization directly ties to the quality of its outcomes. True Zero recognizes that those outcomes begin and end with our people, and that is what we have built a community of like-minded, driven, and passionate individuals and innovators who are aligned in a common goal of delivering top-tier services to our customers. Our culture and commitment have been recognized through numerous accolades, including being named one of the Best Places to Work in 2023 in two categories (“Prosperous and Thriving” ($5MM–$50MM in gross revenue) and “Mid-Atlantic Region” (DC, DE, MD, NC, VA, WV)), and again in 2025 as a Best Places to Work honoree. In addition, True Zero earned coveted spots on the Inc. 5000 list of fastest-growing companies in America in 2022, 2023, and 2025, a testament to our sustained growth driven by our people-first approach and unwavering dedication to excellence.

Position Responsibilities

Roles and Responsibilities

• Own and manage the end-to-end RMF lifecycle, including system categorization, control selection, implementation, assessment, authorization, continuous monitoring, and system disposal.
• Assess and document current-state RMF processes, workflows, roles, data requirements, dependencies, pain points, and approval paths.
• Design and implement standardized target-state RMF processes aligned with NIST, federal agency, and organizational requirements.
• Translate existing RMF workflows, business rules, security documentation, control data, and authorization activities into the new GRC or RMF platform.
• Serve as the primary functional subject matter expert for the new RMF solution, including its workflows, data model, configurations, reporting, and user capabilities.
• Lead requirements-gathering sessions with system owners, ISSOs, ISSMs, security control assessors, authorizing officials, engineers, and compliance stakeholders.
• Define functional requirements, user stories, acceptance criteria, workflow rules, role-based permissions, notifications, and approval processes.
• Review and validate the migration of system records, security controls, assessment results, POA&Ms, authorization packages, evidence, and supporting documentation.
• Identify process gaps, data-quality issues, control-mapping inconsistencies, and configuration deficiencies, and coordinate corrective actions.
• Establish RMF governance standards, operating procedures, templates, process guides, decision points, and quality-control requirements.
• Coordinate solution testing, user acceptance testing, process validation, defect resolution, and production-readiness activities.
• Develop training materials and provide role-based training, demonstrations, and knowledge transfer for users of the new RMF solution.
• Monitor RMF process performance, authorization timelines, control-assessment status, POA&M remediation, and continuous-monitoring activities.
• Provide leadership with dashboards, status reports, risk summaries, implementation updates, and recommendations for process improvement.
• Drive user adoption and continuous improvement by incorporating stakeholder feedback, regulatory changes, lessons learned, and emerging cybersecurity requirements.

Position Qualifications

• Bachelor’s degree in cybersecurity, information technology, information systems, engineering, business, or a related field.
• Eight or more years of experience supporting cybersecurity governance, risk management, compliance, security authorization, or RMF programs.
• Demonstrated experience leading or owning end-to-end RMF processes within a federal government or highly regulated environment.
• Expert knowledge of NIST RMF, NIST SP 800-37, NIST SP 800-53, FIPS 199, FIPS 200, and continuous-monitoring requirements.
• Experience translating current-state business processes into standardized target-state workflows within a new technology platform.
• Experience implementing, configuring, migrating to, or supporting enterprise GRC or RMF platforms such as RegScale, ServiceNow GRC, RSA Archer, eMASS, Xacta, CSAM, or equivalent solutions.
• Strong understanding of authorization packages, System Security Plans, security controls, assessment procedures, POA&Ms, risk assessments, and authorization decisions.
• Experience facilitating process-mapping, requirements-gathering, solution-design, testing, and stakeholder-validation sessions.
• Ability to translate technical, regulatory, and operational requirements into clear system configurations, workflows, and user procedures.
• Strong analytical, documentation, presentation, communication, and stakeholder-management skills.
• Experience leading cross-functional teams and coordinating with system owners, cybersecurity personnel, assessors, engineers, program managers, and executive leadership.
• Ability to identify process risks, resolve competing requirements, and guide stakeholders toward standardized enterprise solutions.

Role Summary

The RMF Process Lead will own and govern the organization’s Risk Management Framework processes and lead the transition from current-state RMF workflows to a modernized target-state solution. This role requires deep knowledge of federal cybersecurity requirements, security authorization processes, control implementation, and enterprise GRC platforms. The RMF Process Lead will serve as the functional subject matter expert for the new solution, translate existing processes and data into optimized workflows, and ensure consistent adoption across cybersecurity, system owner, assessor, and authorization teams.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.