RMF & SAA Program Leadership
· Lead, mentor, and supervise security professionals responsible for end-to-end RMF lifecycle execution for DOJ information systems.
· Direct and coordinate activities within the Prepare step of RMF, ensuring roles, responsibilities, governance structures, and risk management strategies are clearly defined and maintained.
· Guide system categorization efforts to ensure information systems are properly classified based on mission impact, data sensitivity, and regulatory requirements.
Security Engineering & Control Implementation
· Direct the selection, tailoring, and documentation of security controls aligned with system categorizations, DOJ risk tolerance, and compliance requirements.
· Oversee implementation of technical, operational, and management controls across system and application lifecycles, ensuring quality, completeness, and consistency of deliverables.
· Serve as the senior technical authority for security architecture decisions, secure configurations, and remediation strategies.
Assessment, Authorization & Continuous Monitoring
· Ensure comprehensive security control assessments are planned, executed, and documented to validate control effectiveness.
· Prepare and review risk management documentation to support system authorization decisions and executive-level risk acceptance.
· Direct continuous monitoring and ongoing assessment activities, collecting metrics and trends to inform risk posture and adjust security strategies.
Risk, Incident & Audit Support
· Provide subject-matter expertise for cybersecurity risk analysis, incident response, vulnerability remediation, and audit support.
· Support OIG, FISMA, and internal review activities, ensuring systems remain audit-ready and defensible.
Stakeholder Engagement & Reporting
· Serve as a trusted technical advisor to DOJ leadership, system owners, ISSOs, and mission stakeholders.
· Track, report, and communicate security engineering status, risks, and improvement opportunities to Government and contractor leadership.
· Foster collaboration across divisions to ensure consistent application of security best practices.
Training & Continuous Improvement
· Promote a culture of security awareness through technical guidance, mentoring, and training.
· Maintain up-to-date knowledge of RMF, NIST guidance, DOJ policies, and industry best practices.
· Identify opportunities to improve RMF execution efficiency, consistency, and effectiveness through process refinement and approved tooling.