Cyber Security Analyst

Cyber Security Analyst II

ManTech is seeking a Cyber Security Analyst II to support our operations in Virginia Beach, VA. This is an on-site position.

Become an integral part of a diverse team while working at an Industry Leading Organization, where our employees come first. At ManTech, you'll help protect our national security while working on innovative projects that offer opportunities for advancement.

Responsibilities include, but are not limited to:

• Prepare for Risk Management Framework (RMF) execution and perform system categorization by conducting comprehensive mission analysis, defining the authorization boundary with detailed network diagrams, hardware/software inventories, and data flow documentation. Determine mission criticality and apply relevant overlays (e.g., Privacy, Space, Cross-Domain) to establish the appropriate security control baseline per National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 and Department of Defense (DoD)/Navy policy.
• Select, tailor, and document security controls throughout the system lifecycle. Lead control selection and tailoring workshops with stakeholders, justify deviations via risk-based rationale, and document all decisions in Enterprise Mission Assurance Support Service (eMASS). Develop and maintain the System Security Plan (SSP), cybersecurity policies, procedures, plans (e.g., Contingency Plan, Incident Response Plan), and strategies that align with organizational risk tolerance and mission objectives. Ensure cybersecurity architecture supports availability, integrity, confidentiality, authentication, and non-repudiation.
• Implement and test security controls using authoritative sources including Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), Assured Compliance Assessment Solution (ACAS)/Nessus vulnerability scans, and NIST SP 800-53A Revision 5 Assessment Procedures (APs). Execute full-scope testing across all assets impacting Confidentiality/Integrity/Availability (C/I/A), validate configurations, patch levels, access controls, and document implementation status and test results with precision in eMASS. Upload compelling evidence (e.g., scan reports, configuration files, screenshots) to support compliance assertions and enable traceability.
• Assess the effectiveness of security control and Assessment Procedure (AP) implementation by verifying each AP is fully satisfied across the entire authorization boundary. Conduct independent testing, examine artifacts, and interview personnel to confirm operational reality matches documented claims. Determine compliance status (Compliant, Non-Compliant, Not Applicable), identify root causes of deficiencies, and document detailed findings in eMASS. Ensure all non-compliant controls are traced to Plan of Actions & Milestones (POA&M) entries with complete risk analysis.
• Support system authorization by maintaining a complete and accurate RMF accreditation package in eMASS, including the SSP, Security Authorization Package (SAP), engineering documentation, and network drawings. Manage POA&M entries with granular risk assessments (Raw Severity, Mitigations, Predisposing Conditions, Relevance of Threat, Likelihood, Impact, Residual Risk) and coordinate formal workflow actions. Prepare for and support Security Assessment Report (SAR) development and Authorizing Official (AO) decision-making.
• Conduct continuous monitoring by implementing and executing the System Level Continuous Monitoring (SLCM) Strategy. Track control compliance through automated and manual methods, perform monthly vulnerability scans, apply STIG updates, and conduct Annual Security Reviews (ASRs). Communicate significant findings upstream to the Security Control Assessor (SCA)/AO and downstream to inheriting systems. Update the SSP and POA&M to reflect changes in risk posture and ensure the system maintains an acceptable security state.
• Provide expert guidance on RMF compliance, risk management, and security strategies across all RMF steps. Advise leadership on emerging threats, control gaps, and mitigation priorities. Contribute to the development and refinement of organizational information security policies, standards, and guidelines. Foster a culture of security awareness and ensure adherence to DoD, Navy, and industry best practice throughout the system lifecycle.

Minimum Qualifications:

• Bachelor's degree in computer science, cybersecurity, information systems, or related fields.
• 2+ years of direct RMF experience.
• Security+ CE certification
• Experience with ACAS and eMASS training.

Preferred Qualifications:

• CISSP Certification
• Experience with DISA STIG
• Minimum of two (2) years of direct RMF experience. Qualification can be met with a bachelor's degree in computer science, cybersecurity, information systems, or related fields.

Security Clearance:

• Must be US Citizen and Active Secret Security Clearance

Physical Requirements:

• Must be able to remain in a stationary position 70%
• The person in this position needs to occasionally move about inside the office to access file cabinets, office machinery, etc.