Cybersecurity A&A Risk Analyst

Accountabilities:

• Manage the full lifecycle of Risk Management Framework (RMF) activities in accordance with NIST Special Publication 800-37.

• Develop, review, and maintain security authorization documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).

• Review FedRAMP authorization packages and updates, monitor authorization packages in the FedRAMP Secure Repository, and support the assessment and use of cloud services.

• Evaluate and validate security control implementation under NIST SP 800-53 Revision 5, including inherited and agency-implemented controls.

• Conduct security risk assessments aligned with NIST SP 800-30 and provide actionable recommendations to Authorizing Officials and senior stakeholders.

• Support continuous monitoring and ongoing authorization by reviewing vulnerability scans, tracking POA&Ms, and coordinating remediation activities.

• Collaborate with system owners, Information System Security Officers (ISSOs), Cloud Service Providers, and other stakeholders to assess significant system changes and maintain compliance with federal security requirements.

• Analyze federal regulations, agency directives, cybersecurity policies, standards, procedures, and implementation guidance to support compliance.

• Conduct gap analyses, recommend remediation strategies, and contribute to control overlays, security baselines, and control-tailoring guidance.

• Provide subject matter expertise during governance discussions and peer-review cybersecurity policies and documentation for quality, accuracy, and consistency.

• Support enterprise risk reporting, compliance dashboards, and metrics using ServiceNow, as well as internal and external reviews and FISMA reporting.

• Assist with oversight inquiries, corrective-action tracking, and other cybersecurity analysis and documentation activities as required.

Requirements:

• Bachelor’s degree in Cybersecurity, Information Technology, Public Policy, or a related discipline, or equivalent professional experience.

• At least seven years of progressive cybersecurity experience, including a minimum of four years supporting federal Risk Management Framework and Assessment and Authorization (A&A) activities.

• Demonstrated experience implementing the NIST Risk Management Framework and working with federal cybersecurity compliance requirements.

• Professional cybersecurity certification such as CISSP, CISM, or CAP.

• Familiarity with the Federal Information Security Modernization Act (FISMA), the Federal Zero Trust Strategy (OMB M-22-09), and federal cloud security requirements.

• Experience working with FedRAMP-authorized environments and supporting Moderate- and/or High-impact systems.

• Strong understanding of security control assessment, authorization documentation, risk analysis, continuous monitoring, and remediation processes.

• Proficiency with Microsoft 365 applications and the ability to communicate effectively with technical teams, system owners, and executive leadership.

• An active Public Trust clearance or the ability to obtain one.

• Must be a U.S. citizen or legal permanent resident and provide documentation confirming eligibility under the contract requirements. The position also specifies U.S. citizenship in its basic qualifications; applicants should confirm eligibility with the hiring team.

• Preferred experience with ServiceNow, CSAM, or comparable governance, risk, and compliance (GRC) tools.

• Familiarity with Atlassian Confluence and Jira, and experience contributing to enterprise cybersecurity policy initiatives.

• Familiarity with federal guidance on responsible AI use, including Executive Order 13960 and OMB M-25-21 and M-25-22.

• Experience supporting federal research or grant-management systems is an advantage.

• Ability to meet applicable pre-employment screening requirements, including background investigation and drug testing where required.

• Comfortable working for extended periods at a desk and using a computer.

Benefits:

• Annual salary: $110,000–$112,000, depending on qualifications, experience, and location.

• Retirement savings: 401(k) plan with a company match of up to 6%.

• Healthcare coverage: Medical, dental, and vision insurance, including prescription drug coverage.

• Paid time off: Paid leave and holidays to support rest and work-life balance.

• Insurance protection: Basic life and accidental death and dismemberment (AD&D) insurance, with supplemental life coverage options.

• Disability coverage: Short-term and long-term disability insurance.

• Well-being support: Employee Assistance Program (EAP).

• Healthcare savings options: Flexible Spending Account (FSA) and Health Savings Account (HSA), subject to eligibility.

• Professional growth: Training, development, and certification support.

• Additional voluntary benefits: Options for accident, critical illness, and identity theft protection.

• Work arrangement: Remote position within the United States.

• Benefits are subject to applicable eligibility requirements and may change.