Cyber Security Analyst

Senior Security Analyst – ATO / RMF AWS Professional ServicesStrategic Business Systems (SBS) is expanding our cybersecurity team and hiring Senior Security Analysts to support our growing Authority to Operate as a Service (ATOaaS) offering.SBS developed ATOaaS in collaboration with leading technology companies and DoD/Intelligence Community customers to help accelerate the process of bringing innovative commercial technologies into secure government environments.This is a hands-on cybersecurity role supporting technology partners and government customers throughout the Authority to Operate (ATO) and Risk Management Framework (RMF) lifecycle. You'll work directly with customers to understand their technologies, develop security documentation, assess vulnerabilities, implement and document security controls, manage POA&Ms, and help move cloud-based solutions successfully through authorization.The goal is straightforward: help technology providers navigate the government security authorization process faster while maintaining the security and compliance required for mission environments.If you have experience developing ATO packages, understand RMF, and enjoy working directly with customers to solve cybersecurity and compliance challenges, this is a strong fit.What You'll Be DoingSupport customers through the complete ATO and RMF lifecycleDevelop and maintain ATO security packages and authorization documentationWrite clear technical documentation describing how systems are configured, secured, and operatedWork across the RMF lifecycle, including Categorize, Select, Implement, Assess, Authorize, and MonitorAssess security controls against NIST 800-53 requirementsAnalyze STIG and SCAP requirements and document complianceReview vulnerability scans and identify security weaknesses within customer environmentsInterpret results from tools such as Tenable Nessus, Checkmarx, and FortifyDevelop, manage, and update Plans of Action & Milestones (POA&Ms)Track vulnerabilities through remediation, mitigation, or risk acceptanceIdentify and help customers remediate open-day vulnerabilitiesEvaluate configuration changes and their impact on the security posture of enterprise cloud solutionsRecommend mitigating controls and security countermeasuresSupport continuous monitoring following authorizationMaintain security documentation as customer environments and requirements evolveExplain security-control inheritance models and associated resourcesPrepare documentation for system audits and vulnerability assessmentsCommunicate cybersecurity risk and remediation recommendations to technical teams and senior leadershipCustomer & Technical DeliveryThis role involves more than developing security documentation. You'll work directly with SBS technology partners and government customers to help move their solutions through the authorization process.You'll be expected to:Lead technical discussions with customers and technology partnersUnderstand customer systems, architectures, and business requirementsTranslate technical environments into appropriate security controls and authorization requirementsAdvise customers on security best practices and required remediationIdentify technical and cybersecurity risks and recommend mitigation strategiesParticipate in project planning and identify risks, dependencies, and deliverablesDevelop project artifacts and support Work Breakdown Structures (WBS)Communicate project status, risks, and technical requirements to project leadershipProvide guidance and technical leadership to customers and less-experienced security staffWhat We're Looking ForATO / RMF ExperienceHands-on experience supporting and/or managing ATO packages for cloud-based productsExperience supporting solutions used by U.S. government agencies and/or military organizationsStrong experience with ATO writing, security documentation, and package developmentHands-on knowledge of the Risk Management Framework (RMF)Understanding of all RMF lifecycle stepsExperience assessing security controls against NIST 800-53Experience developing and managing POA&MsAbility to understand and explain security-control inheritanceVulnerability & Compliance ManagementExperience identifying and mitigating open-day vulnerabilitiesExperience reviewing and interpreting vulnerability scansKnowledge of STIGs and SCAPExperience with vulnerability and application-security tools such as Tenable Nessus, Checkmarx, Fortify, or similar platformsAbility to recommend appropriate countermeasures and mitigating controlsExperience supporting continuous monitoring and compliance reportingCloud SecurityExperience assessing the security posture of cloud-based environments and productsUnderstanding of cloud security controls, configurations, and compliance requirementsAbility to evaluate configuration changes and determine their potential security impactFamiliarity with firewalls, network security, and intrusion detection systems (IDS) in cloud environments is preferredCustomer-Facing SkillsStrong technical writing and documentation skillsAbility to explain cybersecurity risks and requirements to both technical and non-technical stakeholdersComfortable leading customer meetings and technical discussionsAbility to translate cybersecurity findings into actionable remediation recommendationsSelf-motivated and comfortable working within a small, agile technical teamSecurity & CertificationsActive TS/SCI clearance requiredCI Polygraph preferred but not requiredActive Security+ or higher IAT Level II/III certification requiredCISSP or similar information security certification preferredCloud security or platform certifications are a plusBachelor's degree preferredWhy SBSSBS is a trusted technology and cybersecurity partner supporting federal agencies, the Department of Defense, Intelligence Community, and leading commercial technology companies.Our ATOaaS offering is designed to solve a significant challenge for technology providers: navigating the complex security and authorization requirements necessary to bring commercial technologies into government environments.You'll be part of a team that:Works directly with innovative technology companies and government customersHelps accelerate the delivery of new technologies into DoD and Intelligence Community environmentsWorks across cloud security, ATO, RMF, vulnerability management, and continuous monitoringProvides hands-on guidance throughout the authorization lifecycleHas direct impact on getting new technology into the hands of government and military usersCOMPENSATION & BENEFITSSBS offers a comprehensive total-rewards package, including a market competitive salary along with:Comprehensive medical, dental, and vision coverage; HSA-eligible plan options available401(k) retirement plan with company match (vesting schedule per Plan Document)Paid Time Off, federal holidays, and floating holiday for personal observanceAnnual professional development support for AWS certifications, training, and conferencesEmployee referral program where applicable and documented by program policyLife, AD&D, and short- / long-term disability insuranceTelework and flexible-schedule support where mission and contract permitMission-focused federal contractor supporting national-security customersTarget Salary Range: $140,000-195,000. This range reflects the anticipated compensation for this role. Actual salary will be based on a combination of factors, including the position's scope and level of responsibility, the candidate's relevant experience, education, technical expertise, skills and qualifications, geographic location, and applicable business or contractual requirements.SBS is an equal opportunity employer; all qualified applicants will receive consideration for employment without regard to age, gender, gender identity, sex, sexual orientation, color, race, creed, national origin, religion, marital status, parental status, citizenship status,