About This Role
This role supports a contract by applying expertise in federal information system security policy, security control assessments, and system authorizations. The analyst is responsible for designing and implementing solutions to protect sensitive information's confidentiality, integrity, and availability.
Responsibilities
- Serve as a recognized information security expert in vulnerability assessment, risk assessment, network security, product evaluation, and security implementation
- Design and implement solutions for protecting the confidentiality, integrity, and availability of sensitive information
- Provide technical evaluations of customer systems and assist with security improvements
- Participate in the design of information system business impact analysis, system categorization, contingency plans, privacy documents, and other system security documentation
- Conduct testing and audit log reviews to evaluate the effectiveness of current security measures
- Conduct security product evaluations, and recommend products, technologies, and upgrades to improve the customer's security posture
Requirements
- 5+ years of relevant experience
- Experience with RMF and applying the NIST Cybersecurity Framework
- Substantial knowledge of federal information system security policy, industry best practices, security control assessments, Plan of Action and Milestones (POA&M) management, system authorizations, configuration management, and system analysis
- Experience designing and implementing solutions for protecting the confidentiality, integrity, and availability of sensitive information
- Technical expert providing technical support in vulnerability assessment, risk assessment, network security, product evaluation, and security implementation
- Solid understanding and application of NIST Special Publications including SP 800-53
- Solid understanding of FISMA audit requirements
- Solid understanding of IT audit requirements
- Ability to work cooperatively and at a technical level with developers, engineers, and managers on system teams
- Knowledge of computer networking concepts, protocols, and network security methodologies
- Knowledge of risk management processes and tools (e.g., methods and tools for assessing and mitigating risks)
- Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy in a federal environment
- Knowledge of current and past cybersecurity threats and vulnerabilities
Nice to have:
Benefits
- 20 days PTO + 40 hours of paid sick & safe time
- 11 federal holidays + 2 corporate holidays
