Security Analyst

Can work remote up to five days, however, the candidate must come in if needed including on short notice. At a minimum, the candidate will come in quarterly but could be more frequently as determined by business needs.

Project Details:
The client is seeking a Level III security professional with vulnerability management knowledge, strong documentation and compliance experience, and excellent stakeholder communication skills. Success in this position depends on the ability to work cross-functionally, manage competing priorities, contribute to federal security compliance efforts, and serve as a trusted partner to both security teams and business stakeholders.

This role requires understanding security concepts, technical requirements, and operational processes, and communicating them effectively to non-security audiences. The position contributes to key security and privacy deliverables, including system security and privacy plans, and plays a significant role in developing and maintaining these documents. It also supports vulnerability management efforts across the CARES environment, with a strong focus on tracking, monitoring, and ensuring remediation activities are completed.

This work is completed by engaging other security staff, communicating risk, and developing strategies to reduce risk. To successfully do this work, one must possess strong communication and interpersonal skills capable of presenting to diverse audiences including executive and non-technical individuals.

A federally recognized (ANSI) information security certification must be obtained within 6 months of the start date and maintained for this position. The Department of Defense (DOD) 8570 Baseline Certifications defined by Defense Information Systems Agency (DISA) is the baseline to consider when reviewing the relevance of the certification.

Goals and Worker Activities

1. Integrate security into program operations
Partner with organizational leaders to incorporate information security best-practices into technical and operational development.
Provide recommendations on how to improve the information security posture of programs and reduce risk.
Communicate risks in simple and comprehensible terms. Provide options to mitigate risk considering business impact.
Draft security requirements to be included into charters, scope documents, procurements.
Document and communicate analysis. Answer clarifying questions.
Escalate to ISS leadership if an acceptable level of risk cannot be achieved

2. Act as a liaison between the program area and the Information Security Section
Be a solutions-focused advocate.
Intake projects and other program initiatives and champion them through the appropriate ISS workstream
Gather information as needed so that security team can perform thorough analysis
Communicate workstream deliverables to the customer. Verify that the deliverable meets the customer need, follow-up on any clarifications.
Coordinate across ISS meeting their security-focused needs
Coordinate with other client staff, Office of Legal Counsel, Bureau of Procurement and Contracting, and other program staff as needed in order to arrive to an outcome

3. Support audit, assessment, incident response, and other regulatory activities
Responsibility and authority will vary based on the use case and customer need.
Request and/or gather artifacts demonstrating compliance.
Schedule/facilitate communications between auditor/incident response, vendors, technical teams, and other program stakeholders.
In partnership with ISS, assess audit results and develop corrective action plans/plans of action and milestone.
Provide oversight to the resolution, test for compliance, and request authority to close.
Respond to regulatory inquiry and draft documents as needed

4. Participate and support Program Integration related activities
Back-up other security liaison roles
Draft and deliver status reports
Establish and maintain positive working relationships with stakeholders
Establish and documents standard operations for job-related activities.

5. Support Vulnerability Management related to the client and its vendors
Foster transparency, accountability, and timely resolution of vulnerabilities with the client and its vendors
Support the client and its vendors in adhering to client regulations and Policies, Procedures, Standards and Guidelines (PPSGs) related to vulnerability management
Draft and monitor plans of action and milestones for non-compliance

6. Support the client's transition from the Center for Medicare and Medicaid Services (CMS) compliance requirements known as the Minimum Acceptable Risk Standards for Exchanges (MARS-E) to the new requirements known as Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE)
In partnership with vendor, the client department conduct GAP analysis to support transition, implementation, and maturation of the client's transition from MARS-E to ARC-AMPE
Draft the ARC-AMPE System Security and Privacy Plan (SSPP) and keep it current

7. Support the client in completing software reviews, cloud brokerage reviews, and AI Use Case reviews

8. Other duties as assigned
Back-up other security staff
Write concept papers, proposals and briefs, and other documentation

Knowledge, Skills, and Abilities
Well qualified candidate will have broad knowledge of information security and experience application development, technical architecture, contracting, audit, or vendor management.
Be familiar with NIST or another recognized framework
Demonstrated ability to solve complex problems, convey both oral and written instruction, and handle multiple task interruptions while providing services in a professional and courteous manner.
Demonstrated attention to detail and organizational skills.
Demonstrated ability to work effectively with customers to solve business challenges while balancing the need for confidentiality, integrity, and availability.
Demonstrated commitment to fostering a diverse working environment.
Demonstrated ability to work independently, as part of a team of peers, and also to support and contribute to a multidiscipline team environment.

Notes:
Can work remote up to five days, however, the candidate must come in if needed including on short notice. At a minimum, the candidate will come in quarterly but could be more frequently as determined by business needs.

VIVA is an equal opportunity employer. All qualified applicants have an equal opportunity for placement, and all employees have an equal opportunity to develop on the job. This means that VIVA will not discriminate against any employee or qualified applicant on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status