IT Security Analyst T3 (580)

Job Description

Herndon, VA — Hybrid (Tue / Wed / Thu Onsite)\n
\n
\n
\n Contract to Hire US Citizens Only \n
\n
\n
\n No Dual Citizenship\n
\n
\n
\n
\n FedRAMP / RMF DoD / NIST\n
\n
\n The Security Analyst will work as a member of our client's cyber team, assisting with the creation, update, and maintenance of FedRAMP-required security documentation, associated artifacts, and Continuous Compliance Monitoring (CCM) requirements such as the Plan of Action and Milestones (POA&M). The role also supports the Cloud Operations team with identification and corrective actions associated with known vulnerabilities, and provides advisement to stakeholders on changing regulatory, government, and Cloud/FedRAMP policies — including risk assessment, business impact analysis, system categorization, security authorization and accreditation/certification activities (A&A), security control inheritance, and other artifacts needed to validate control compliance.\n
\n
\n ? Critical Requirements\n
\n
\n Required Skills\n
\n
\n Compliance & Governance\n
\n

\n
• Understand and document information system specifications and security controls, including logical and physical diagrams, connectivity, communication, and data flow diagrams — both internal and external to the system
\n
• Advise stakeholders on multiple courses of action in environments with changing or unconfirmed policy (e.g., NIST RMF, DISA SRG)
\n
• Document courses of action and identify risk mitigation recommendations in accordance with FedRAMP requirements, client policy, and best practices — including associated benefits and drawbacks
\n
• Apply enterprise security frameworks (FISMA, NIST SP 800, etc.) to existing cloud environment initiatives
\n
• Develop and update policies and procedures to implement FedRAMP compliance, NIST 800-171 security requirements, and other DFAR clauses
\n
• Demonstrate familiarity with current FedRAMP, DoD, and NIST security controls and technologies, including vulnerability management capabilities
\n
• Identify and assess cloud system state including vulnerabilities, RMF package status, accreditation model, PPS compliance, and patching/CSVA mechanisms
\n

\n
\n Vulnerability Management\n
\n

\n
• Knowledge of Risk-Based Vulnerability Framework and how to prioritize, assess, and remediate exploitable vulnerabilities
\n
• Ability to create automation scripts to minimize manual workload behind identifying and analyzing vulnerabilities across various scanning tools
\n
• Ability to analyze container vulnerabilities in secure cloud environments and identify remediation paths at the OS and application level
\n
• Understand enterprise operating environments including security posture, application environment, and associated security controls
\n

\n
\n Required Technical Experience\n
\n
\n Technical Skills\n
\n
\n Python, Bash, Java & PowerShell Scripting\n
\n
\n Container Scanning Tools\n
\n
\n CI/CD Pipelines & AWS ECR\n
\n
\n Container Image Mirroring\n
\n
\n Attack Vector Analysis\n
\n
\n Network Diagrams & Visio\n
\n
\n SAP Products\n
\n
\n Testing / Dev / Staging Environments\n
\n
\n RMF & Compliance Experience\n
\n

\n
• Demonstrated knowledge and ability to analyze systems for cybersecurity compliance
\n
• Knowledge of Federal and DoD policies and risk assessment methodologies including FedRAMP, NIST SPs, and RMF overlays
\n
• Hands-on experience with DISA STIG requirements and SRGs, CNSSI, and NIST Risk Management Framework
\n
• Experience writing or executing system security documentation, Authorization to Operate (ATO) packages, POA&Ms, and policies
\n
• Knowledge and understanding of systems and networking technologies and concepts
\n
• Ability to interpret and assess network diagrams using Visio
\n
• Familiarity with Testing, Development, Staging, and pre-production environments requiring cybersecurity support
\n
• Knowledge of the Privacy Act
\n
• Presentation and public speaking skills required
\n
• Ability to work in a fast-paced, team-oriented environment
\n