Who we are

Tria Federal delivers digital services and technology solutions that support the health and safety of veterans, service members and civilians. For two decades, federal agencies have relied on Tria companies to advance their critical missions and modernize their systems, so that they can uphold their commitment to the American people. Today, we are pushing the boundaries of possibility through partnerships and investments in artificial intelligence and emerging technologies, developing solutions for the biggest challenges that government will face tomorrow.

We are proud to employ and support military veterans who bring mission-first mindset, technical expertise, and leadership qualities that strengthen our work. Veterans, transitioning service members, and military spouses are strongly encouraged to apply.

Job Description:

We are seeking an experienced Cybersecurity Governance, Risk, and Compliance (GRC) / Risk Management Framework (RMF) Lead to oversee and execute cybersecurity activities supporting complex federal healthcare environments. The successful candidate will demonstrate a proven ability to lead multidisciplinary cybersecurity teams, manage multiple concurrent system authorization packages, and navigate the technical, regulatory, and operational challenges associated with federal information security programs.

This position requires a hands-on leader who can balance strategic oversight with direct technical contributions, taking ownership of team performance, deliverable quality, and the timely execution of cybersecurity activities. The ideal candidate possesses strong working knowledge of federal cybersecurity requirements, sound risk-based decision-making skills, and the ability to independently identify challenges, develop actionable solutions, and communicate effectively with government stakeholders, technical teams, and organizational leadership.

Basic Requirements:

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, or an equivalent combination of relevant education and professional experience.
Demonstrated professional experience supporting federal cybersecurity programs, including direct involvement in NIST RMF activities, FISMA compliance, and system authorization processes.
Demonstrated experience leading or coordinating cybersecurity practitioners, managing competing priorities, and ensuring the quality and timely completion of technical and compliance deliverables.
Strong working knowledge of NIST SP 800-37, NIST SP 800-53, and related federal information security requirements and guidance.
Experience developing, reviewing, and maintaining system authorization documentation and supporting artifacts.
Demonstrated ability to evaluate technical security findings, assess organizational risk, and recommend appropriate remediation or mitigation strategies.
Strong written and verbal communication skills, including the ability to communicate cybersecurity risks and recommendations to technical personnel, government stakeholders, and organizational leadership.
Ability to obtain and maintain the required federal Public Trust designation or other customer-required suitability determination.
Must reside in and be authorized to work in the United States.
Must meet applicable federal contract residency requirements, including having resided in the United States for at least three of the preceding five years.

Preferred Qualifications

Experience supporting cybersecurity, risk management, and compliance activities within large-scale Salesforce implementations, including familiarity with Salesforce security architecture, access controls, data protection, integrations, and platform-specific security considerations.
Experience working with cloud-based enterprise applications and infrastructure, particularly Amazon Web Services (AWS), in federal or similarly regulated environments.
Experience utilizing security and development platforms such as Snyk, GitHub, Jira, and Confluence to support vulnerability management, DevSecOps activities, security documentation, and remediation tracking.