Mid-Level A&A Package Specialist

As the A&A Package Specialist, you will play a critical role in helping client systems move through the authorization process.

You will develop foundational security documentation, assemble complete authorization packages, and support the evidence needed for informed authorization decisions.

In this role, you will:

• Develop and maintain RMF authorization artifacts, including the System Security Plan (SSP), Business Impact Analysis (BIA), FIPS 199 categorization, Privacy Threshold/Impact Assessments (PTA/PIA), Configuration Management Plan (CMP), and e-Authentication documentation.
• Create foundational system documentation, including Boundary Scope Memorandums (BSM), System Architecture diagrams, and Authorization Boundary and Network Diagrams (ABND).
• Support system owners with control scoping, tailoring, and identification of applicable overlays such as the client's AI Overlay.
• Map system inheritance from Common Control Providers and assist with Interconnection Security Agreements (ISAs) and Memorandums of Understanding (MOUs).
• Technically validate system-level evidence such as configuration screenshots, log samples, and scan reports for accuracy and compliance with NIST SP 800-53 Rev. 5 before inclusion in the SSP.
• Guide system owners through the full RMF lifecycle for new systems and reauthorization efforts.
• Support system categorization, impact analysis, and security control selection.
• Apply the NIST AI Risk Management Framework (AI RMF 1.0) and relevant OMB guidance for systems incorporating Artificial Intelligence or Machine Learning capabilities.
• Develop system-level Contingency Plans (CPs) and Incident Response Plans (IRPs) and support coordination and documentation of annual CP and IRP testing.
• Assemble authorization packages for submission to the Security Control Assessor (SCA) and Authorizing Official (AO) and track them through the authorization decision process.
• Support the development and tracking of corrective actions and Plans of Action and Milestones (POA&Ms) identified during package development and assessment.
• Bachelor's degree in a related field, or equivalent experience as allowed by company and contract policy.
• Five or more years of RMF and A&A package development experience.
• Hands-on experience authoring SSPs, BIAs, FIPS 199 categorizations, PTA/PIA documentation, and Configuration Management Plans.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53 Rev. 5, NIST SP 800-18, and FIPS 199.
• Demonstrated experience supporting systems through the ATO process through final AO decision.
• Strong attention to detail, organizational discipline, and the ability to manage multiple documentation workflows at once.
• Ability to meet federal background investigation requirements.

• Active certification such as CISSP, CGRC/CAP, or CompTIA Security+.
• Experience with GRC or authorization tools such as eMASS, CSAM, Xacta, or JCAM.
• Experience supporting FedRAMP or cloud-based RMF efforts in AWS and/or Azure.
• Prior support to federal civilian agency cybersecurity programs.

We're invested in the people who make our success possible.

As a K2United employee, you'll enjoy a comprehensive benefits package designed to support your professional and personal well-being, including:

• 401(k) with employer matching
• Low-cost medical coverage for employees and their families
• Paid time off
• Paid leave for jury duty, military service, voting, and other qualifying events
• Wellness stipend, including fitness reimbursement
• Tuition assistance
• Casual work environment
• Technical training and certification support
• Complimentary access to CareerSafe online training courses for employees and their immediate family

K2United is an equal opportunity employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, protected veteran status, or any other characteristic protected by applicable law.