Senior RMF Policy Analyst

Title:

Senior RMF Policy Analyst

At KBR, we deliver science, technology and engineering solutions to governments and companies around the world. KBR employs approximately 37,000 people worldwide with customers in more than 85 countries and operations in over 28 countries. KBR is proud to work with its customers across the globe to provide technology, value-added services, and long-term operations and maintenance services to ensure consistent delivery with predictable results.

Trinzic is the future independent company to be created through the planned spin-off of KBR's Mission Technology Solutions business, expected in January 2027. Our people work at the frontier of what is possible, delivering solutions in challenging environments and advancing some of the world's highest-priority national security and space missions.

Backed by decades of mission success, deep expertise, and trusted partnerships, Trinzic will launch as a global organization with more than 18,000 employees supporting customers around the world. Join us at a defining moment and help shape the future of a company built to tackle complex challenges and make a meaningful impact.

Candidates who join KBR's Mission Technology Solutions business before the spin-off will transition to Trinzic when the separation is complete and will not need to reapply for employment.

KBR is seeking a highly skilled Senior RMF Policy Analyst to support cybersecurity governance, Risk Management Framework (RMF) compliance, and Assessment & Authorization (A&A) efforts within a complex Department of Defense (DoD) environment. The successful candidate will serve as a trusted cybersecurity subject matter expert responsible for developing, maintaining, and enhancing RMF policies, standard operating procedures (SOPs), training materials, and documentation that support mission-critical systems and applications. This role requires extensive knowledge of DoD cybersecurity requirements, eMASS, NIST guidance, and DHA authorization processes, along with the ability to collaborate across technical and program teams to improve compliance, automate workflows, and ensure adherence to evolving cybersecurity standards.

The ideal candidate is a self-driven professional with strong analytical, communication, and leadership skills who can effectively manage multiple priorities while serving as a key advisor on RMF policy, cybersecurity documentation, training, and process improvement initiatives.

Role and Responsibilities:

• Review, analyze, and update existing A&A Process SOPs to reflect current Government-approved practices.

• Review and update, where and when needed, the existing certification/testing model so it reflects best business practices in information technology/security once approved by the Government.

• Review current processes and recommend/develop automated processes in the areas of application risk assessments and additionally update/map these processes to existing interactive workflows and processes in SharePoint.

• Function as the primary Point of Contact with responsibility for the development and maintenance of the cybersecurity SOPs.

• Provide subject matter expertise in the area of DoD and DHA A&A requirements.

• Ensure accuracy of the information introduced in the SOPs and institute and exercise proper change control mechanisms when proposing or making changes to the technical, functional, or contextual information contained in the SOPs.

• Ensure the accuracy and correctness of the procedures and processes in the SOPs by utilizing a thorough Quality Assurance (QA) plan.

• Maintain all RMF/DIACAP documentation templates associated with A&A efforts and associated deliverables.

• Create, maintain, and manage training materials for approval by the Government.

• Apprise users about available assistance as well as technical security products and techniques. Varying levels of security training are required depending on a person's roles and responsibilities.

• Attend weekly CCB/SCAR Tiger Team meetings and monthly ACAS/CMRS meetings to understand issues and changes which drive potential updates to training content.

• Understand how eMASS functions and provide responses to technical and cyber-related questions.

Basic Qualifications

• Bachelor's degree in Engineering, Physics, Network Security, Computer Science, or related field. In lieu of a degree, 15 years of relevant experience may be considered.

• Ten (10) years of experience in Engineering, Systems Analysis, Medical Systems, Cybersecurity, Web Development, or Engineering Management.

• Five (5) years of technical experience supporting cybersecurity, network protection, or virtualization projects.

• Demonstrated experience with RMF Steps 1-5.

• Working knowledge of eMASS (Enterprise Mission Assurance Support Service).

• Knowledge of NIST SP 800-53, NIST SP 800-37, CNSSI 1254, and applicable DoD Risk Management policies.

• Experience developing RMF cybersecurity documentation.

• Familiarity with vulnerability scanning and assessment tools used to identify, assess, and document compliance.

• Ability to lead teams and effectively interact with senior-level program personnel and government stakeholders.

• Ability to manage multiple priorities and projects simultaneously.

• Strong written, verbal, and customer service communication skills.

• Self-starter with the ability to work independently while collaborating in a dynamic team environment.

• Active Secret clearance required.

• Current CompTIA Security+ certification or DoD 8570 IAT/IAM Level I (or higher) certification required.

Preferred Qualifications

• Experience supporting the Defense Health Agency (DHA) Cyber Security Directorate.

• Experience developing, maintaining, or updating cybersecurity policies, SOPs, and training materials.

• Experience conducting cybersecurity training in virtual and/or classroom environments.

• Experience supporting Assessment & Authorization (A&A) efforts for DoD systems.

• Experience with SharePoint workflow development, process automation, and application risk assessment processes.

• Familiarity with RMF/DIACAP documentation templates and A&A deliverables.

• Advanced degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related technical field.

Scheduled Weekly Hours: 40 hours/week.

Compensation: $115,000-140,000. The salary range posted is based on the national average. The offered rate will be based on the selected candidate’s location, knowledge, skills, abilities, and/or experience, contract affordability, and in consideration of internal parity.

Additional Compensation: KBR may offer bonuses, commissions, or other forms of compensation to certain job titles or levels per internal policy or contractual designation. Additional compensation may be in the form of a sign-on bonus, relocation benefits, short-term incentives, long-term incentives, or discretionary payments for exceptional performance.

KBR Benefits: KBR offers a selection of competitive lifestyle benefits which could include 401K plan with company match, medical, dental, vision, life insurance, AD&D, flexible spending account, disability, paid time off, or flexible work schedule. We support career advancement through professional training and development.

Belong, Connect and Grow at KBRAt KBR, we are passionate about our people and our Zero Harm culture. These inform all that we do and are at the heart of our commitment to, and ongoing journey toward being a People First company. That commitment is central to our team of team’s philosophy and fosters an environment where everyone can Belong, Connect and Grow. We Deliver – Together.

KBR is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.