Cyber Security Analyst

Position Description Summary: The Cybersecurity Assessment and Authorization Subject Matter Expert supports the assessment, authorization, and continuous monitoring of DLA information systems, applications, cloud services, operational technology, and related IT environments. The SME executes Risk Management Framework activities, evaluates security control compliance, identifies residual risk, develops authorization documentation, and advises government stakeholders on system security posture and authorization decisions. Responsibilities: Execute cybersecurity Assessment and Authorization activities throughout the system development life cycle Support all phases of the Risk Management Framework, including preparation, categorization, control selection, implementation, assessment, authorization, and continuous monitoring Assess and validate security controls in accordance with NIST SP 800-53, DoD guidance, and DLA cybersecurity policies Prepare and maintain System Security Plans, Security Assessment Reports, Risk Assessments, Continuous Monitoring Strategies, POA&Ms, Privacy Impact Assessments, and authorization packages Register and maintain systems and authorization documentation within eMASS Review ACAS scan results, STIG compliance, IAVA requirements, vulnerabilities, and remediation activities Determine the residual risk and operational impact of cybersecurity vulnerabilities and control deficiencies Support authorization reviews for complex environments, including cloud-hosted services, operational technology, automated information systems, enclaves, and outsourced IT processes Brief senior management, Authorizing Officials, program managers, system managers, and ISSMs on cybersecurity posture, risks, findings, and RMF progress Monitor system changes and cybersecurity events that may affect authorization status or security posture Support incident reporting, corrective actions, risk acceptance decisions, and continuous monitoring requirements Prepare project plans, schedules, implementation documentation, status reports, and cybersecurity posture briefings Coordinate with government personnel, contractors, information owners, data stewards, and technical stakeholders Maintain accurate and current cybersecurity documentation and support inspections, audits, tests, and reviews Skills & Experience: Minimum of seven (7) years of relevant Certification and Accreditation or Assessment and Authorization experience Experience executing the DoD Risk Management Framework and supporting system authorization activities. Experience supporting DLA RMF environment as Subject Matter Expert is preferred. Experience applying NIST SP 800-53 security controls to large and complex IT environments DoD cybersecurity experience Experience assessing security controls and conducting authorization reviews for large, complex organizations Knowledge of eMASS, System Security Plans, Security Assessment Reports, POA&Ms, Risk Assessments, and authorization packages Experience with continuous monitoring, ACAS vulnerability scanning, STIG validation, IAVA compliance, and remediation tracking Ability to evaluate security findings and determine residual risk and potential impacts to system authorization Experience supporting cloud environments, operational technology, facility-related control systems, applications, enclaves, and IT infrastructure Strong technical writing, documentation, analytical, briefing, and stakeholder communication skills Ability to present cybersecurity risks and technical findings to senior leadership Ability to maintain all required cybersecurity certifications throughout the period of performance Education: DoD-approved IAM Level III baseline certification in accordance with DoD 8570/8140 requirements A bachelor’s degree in computer science, information technology, information systems, engineering, or a related technical discipline is preferred. Relevant certification from a nationally recognized technical authority Security Clearance Required: Active Secret Security clearance Favorably completed Moderate Risk, Non-Critical Sensitive Tier 3 investigation, formerly NACLC or ANACI Must be eligible for access to classified and sensitive information, including SIPRNET and Controlled Unclassified Information #J-18808-Ljbffr