RMF Instructor- Security Control Implementation Statements

RMF Instructor- Security Control Implementation Statements

Contract - 1099 | Remote-Hybrid | Washington, D.C.

Cybervance is a rapidly growing information security and information technology company based in Washington, D.C. We are an equal opportunity employer.

Cybervance combines advanced cybersecurity expertise with proven federal contracting experience to deliver innovated, mission-focused solutions for U.S. Government agencies. We are committed to helping our partners achieve measurable improvements in security and resilience.

Job Description

Cybervance is seeking skilled instructors to deliver live virtual training for ISSOs, system owners, and security managers working on cloud, hybrid, and FedRAMP systems. We are looking first for a strong, engaging instructor, backed by practitioner-level RMF expertise and instructional design skills to build and refine course content.

The program includes an RMF course covering boundary definition, categorization, control allocation, assessment, authorization, and continuous monitoring, plus three control-family courses: Identity and Access (AC, IA, PS); Detection, Response, and Recovery (AU, CA, CP); and Secure Configuration and Vulnerability Management (CM, SI, SA, SC). All courses focus on writing high-quality security control implementation statements, using a standardized cycle: Gather, Write, Verify. Each course runs one day and is offered multiple times annually.

Responsibilities

Deliver engaging, hands-on live virtual labs and Essentials sessions, adapting pace and depth for audiences ranging from new ISSOs and managers to experienced practitioners.
• Facilitate mock interviews with role-players such as system owners, IT staff, auditors, and assessors, coach students through each Gather, Write, Verify cycle, and give specific, actionable feedback on their drafts.
• Teach boundary definition for systems with cloud and SaaS components, using Common Criteria concepts and FedRAMP guidance, and control allocation across common control providers, cloud providers, and the system.
• Teach students to write statements that name the boundary components each part covers, show how the control is allocated (inherited, hybrid, or system-specific), and fill in organization-defined parameters such as who, how fast, and how often.
• Run verification exercises against simulated configurations, scans, logs, and account listings using NIST SP 800-53A methods (examine, interview, test).

• Guide students through assessment, authorization, and change scenarios: assessor interviews, evidence requests, POA&M entries, risk statements, AO decision briefs, and continuous monitoring plans.
• Design, develop, and refine course materials, including learning objectives, labs, simulated artifacts, and grading rubrics.

Required Qualifications

• Proven experience delivering engaging technical training to adult learners, preferably security or compliance professionals, in live virtual settings with hands-on labs.
• Strong facilitation skills, including leading role-plays and group exercises and adapting to mixed experience levels.
• Extensive hands-on RMF experience (e.g., ISSO, ISSM, or assessor), including writing SSPs and implementation statements and supporting systems through assessment and authorization.
• Direct experience with cloud or hybrid systems and FedRAMP packages, including boundary definition and control allocation.
• In-depth knowledge of NIST SP 800-37, SP 800-53 Rev. 5, SP 800-53A, and FIPS 199/200.
• Experience designing technical training: writing measurable learning objectives, structuring curricula, and building hands-on labs and assessments.
• Strong technical writing skills and the ability to give constructive feedback on others' writing.

Preferred Qualifications

• A track record of strong learner evaluations, or experience teaching certification prep courses (e.g., CGRC, CISSP).
• Certifications such as CGRC, CISSP, CCSP, or cloud security certifications from AWS, Azure, or Google Cloud.
• Experience as a FedRAMP 3PAO or security control assessor.
• Familiarity with Common Criteria (ISO/IEC 15408).
• Familiarity with GRC tools such as Xacta or CSAM.
• Formal instructional design training or certification, or experience applying models such as ADDIE or SAM.