• 
  IT IS 100 % ON SITE POSITION in Santa Rita
• 
  Clearance: Active Tier 5 (T5) Top Secret security clearance
• 
  Must be a United States citizen.
• 
  Must maintain a Privately Owned Vehicle
• 
  Primary Work Location: NAVFAC Marianas, Building 3190, Naval Base Guam (NBG), Santa Rita, Guam 96915
• 
  Secondary Sites: Marine Corps Base Camp Blaz (MCBCB), Andersen Air Force Base (AAFB), Guam
• 
  Employment Terms: Full-Time (40 hours/week, standard business hours; 100% in-person; remote telework not authorized)

POSITION OVERVIEW

KEY RESPONSIBILITIES & ESSENTIAL TASKS

• 
  Drive end-to-end Risk Management Framework (RMF) lifecycle execution (Steps 1–6) in strict
  alignment with DoN and NAVFAC Echelon II directives.
• 
  Format, verify, and upload system inventories, security controls, and compliance artifacts into the
  Enterprise Mission Assurance Support Service (eMASS).
• 
  Facilitate annual security reviews and author Memorandums for Record (MFRs) for system baseline
  modifications to attain and maintain Authorities to Operate (ATOs) for FRCS assets.

• 
  Develop and execute an overarching Vulnerability Management Strategy tailored to the FRCS
  operational environment.
• 
  Conduct automated scanning and compliance checks using DoN-approved tools (e.g., ACAS/Nessus,
  SCAP, Evaluate STIG).
• 
  Perform manual STIG and Security Requirements Guide (SRG) validations (.ckl / .cklb files), generate
  Security Center and eMASSter reports, and upload scan results to the Vulnerability Remediation Asset
  Management (VRAM) database.

• 
  Sustain System-Level Continuous Monitoring (SLCM) by analyzing audit logs, driving vulnerability
  mitigations, and updating quarterly Plan of Action and Milestones (POA&M) reports.
• 
  Serve as a technical representative and Configuration Management (CM) Officer on the Configuration
  Control Board (CCB), providing authoritative security impact analyses and risk assessments.

• 
  Provide on-site technical testing and validation support to satisfy RMF Step 4 requirements in
  coordination with independent validators.
• 
  Serve as an operational member of the MAR Cyber Emergency Response Team (CERT), participating in
  on-call rotation schedules and authoring After-Action Incident Response (IR) reports.
• 
  Provide bi-weekly RMF progress reports to the Information Systems Security Manager (ISSM) and update FRCS project records in Maximo and/or eProjects.

Requirements

REQUIREMENTS & SKILL SETS

• 
  General RMF Experience
  : Recommended minimum of 5 years of hands-on Risk Management
  Framework (RMF) experience.
• 
  FRCS Specialization:
  Minimum of 1 year of specialized experience working on Facility-Related Control
  Systems (FRCS) performing RMF and cybersecurity engineering tasks.
• 
  Independent Execution: Demonstrated ability to operate independently with minimal government
  supervision.
• 
  Formal Degree: A formal college degree

• 
  Intermediate Level (Minimum): Security+, CCSP, Cloud+, GICSP, GISF, or GSEC.
• 
  Advanced Level (Automatically Qualifies): CISSP-ISSEP, CYSA+, RCCE Level 1, CISSO, FITSP-O, GCLD, GCSA, or GSNA.
• 
  Requirement: Complete a minimum of 20 hours annually of Continuous Professional Development (CPD) to keep credentials active.

• 
  Platforms & Databases: eMASS, VRAM, eMASSter, Maximo, eProjects.
• 
  Scanning & Analysis Tools: ACAS (Nessus), SCAP Compliant Scanners, Evaluate STIG, .ckl/.cklb STIG Viewer checklists.
• 
  Frameworks & Standards: NIST SP 800-53 control families, NIST SP 800-82 (ICS/OT), DoN/NAVFAC Echelon II business rules, SRGs/STIGs.

• 
  Capable of physical exertion typical of industrial and FRCS sites: long periods of standing, walking over rough/uneven surfaces, bending, crouching, climbing ladders, and lifting IT equipment up to 25 lbs.
• 
  Must maintain a Privately Owned Vehicle (POV) or company vehicle for required local commuting between sites across Guam (expenses are non-reimbursable as a cost of doing business).