Senior OT Cybersecurity / RMF Lead

Location: Urbana, Maryland, USA (hybrid, with occasional onsite attendance)

Employment Type: Full-time | Permanent

Pay: Up to $140,000.00 per year

The Role

NETbuilder is looking for an experienced Senior OT Cybersecurity / RMF Lead to support a newly awarded U.S. government cybersecurity project based in Urbana, Maryland.

You will lead the technical cybersecurity and Risk Management Framework (RMF) workstream, overseeing security architecture, compliance requirements, and authorization activities across operational technology (OT) environments.

As this is a new project, you will also play a key role in establishing cybersecurity governance, processes, and ways of working, helping shape the team’s approach from the ground up.

You will work closely with engineers, cybersecurity specialists, and government stakeholders, providing technical leadership and ensuring security controls, documentation, and authorization requirements are delivered to a high standard.

This is not a fully remote role. Occasional onsite attendance in Urbana, Maryland is required, which may be weekly or monthly depending on project needs.

What You Will Do

• Lead RMF and Authority to Operate (ATO) activities, from system categorization through authorization.
• Define, assess, and review OT cybersecurity architecture across industrial control systems, networks, and supporting IT infrastructure.
• Apply and tailor NIST SP 800-53 security controls to OT environments, ensuring alignment with applicable government security requirements.
• Lead the development and review of security documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Oversee technical security assessments, control implementation, evidence collection, and remediation activities.
• Help establish cybersecurity governance, policies, procedures, and operational processes for a newly formed project team.
• Provide technical leadership and guidance to cybersecurity engineers and other project specialists.
• Identify security risks, vulnerabilities, and remediation priorities, ensuring appropriate mitigation strategies are implemented.
• Collaborate with government stakeholders, assessors, and technical teams to support compliance and authorization activities.
• Review technical deliverables to ensure they meet security, regulatory, and project requirements.
• Represent the technical workstream in meetings with government stakeholders and support ongoing security and compliance discussions.

What You Bring

• 10+ years of cybersecurity experience, including at least 5 years working with OT, ICS, or industrial control environments.
• Proven hands-on experience leading RMF and ATO activities, including security control assessments, authorization documentation, and coordination with government stakeholders.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53, and NIST SP 800-82.
• Experience developing, reviewing, and maintaining security documentation, including SSPs, SARs, and POA&Ms.
• Strong understanding of industrial control systems, OT network architectures, and industrial communication protocols such as Modbus, DNP3, and EtherNet/IP.
• Experience leading technical cybersecurity activities and providing guidance to engineering teams.
• Ability to establish and implement cybersecurity governance frameworks, policies, procedures, and operational processes.
• Experience assessing cybersecurity risks, implementing security controls, and supporting vulnerability remediation.
• Strong communication, problem-solving, and stakeholder management skills, with the ability to explain complex technical matters to both technical and non-technical audiences.
• Eligibility to work in the United States.
• Ability to attend onsite in Urbana, Maryland on an occasional basis (weekly or monthly).

Nice to Have

• Relevant cybersecurity certifications such as CISSP, GICSP, CISM, GIAC GRID, or equivalent.
• Active U.S. security clearance or eligibility to obtain one.
• Experience using eMASS or similar government security authorization tools.
• Previous experience supporting U.S. federal government cybersecurity projects.
• Experience establishing cybersecurity governance and operational processes for new teams or projects.
• Familiarity with the Purdue model and industrial network segmentation.
• Background in OT environments such as energy, utilities, manufacturing, water, facilities, or critical infrastructure.

About NETbuilder

NETbuilder is a specialist technology partner founded in 1999. We help enterprises and mid-market organizations lead technology transformation through specialist consulting, managed services, and enterprise insourcing across security, ServiceNow, observability, and agentic automation.