5+ years supporting Risk Management Framework (RMF) in a DoD environment
3+ years supporting full ATO lifecycle
3+ years applying DISA Security Technical Implementation Guides (STIGs) across various technologies
3+ years identifying STIG findings and documenting mitigations
3+ years preparing for Command Cyber Readiness Inspection support
CompTIA Security+ certification
Responsibilities
Bridge technical teams and government security frameworks
Ensure compliance with DoD cybersecurity mandates
Manage security boundaries for systems and applications
Conduct internal compliance reviews and audits
Track and report on CCRI remediation plans
Enforce Information Assurance Vulnerability Management directives
Produce monthly security status and compliance reports
Benefits
Opportunities to support the Department of Defense mission
Engagement in a significant upcoming program
Collaborative work environment with technical teams
Professional development in cybersecurity and information assurance
Exposure to a variety of technologies and security frameworks
Full Job Description
ITility is seeking a Cybersecurity Analyst/Information Assurance to support the overall mission of the Department of Defense (DoD) by focusing on knowledge management, information sharing, collaboration, data, business processes, and digital capabilities. This effort provides significant opportunities for an upcoming program.
As a Cybersecurity Analyst/Information Assurance (TS), you will be the bridge between the technical team that builds and operates Enterprise Knowledge Management and the government's security authorization framework. You will ensure that every system, application, platform, and data asset within the EKM program operates within an approved security boundary and maintains continuous compliance with DoD cybersecurity mandates.
Required Qualifications:
ACTIVE TS clearance
Five (5+) years supporting Risk Management Framework (RMF) per NIST SP 800-37and DoDI 8510.01 in a DoD environment
Three (3)+ years of experience supporting full ATO lifecycle - categorization, security control selection, implementation, assessment, authorization, continuous monitoring
Three (3)+ years of experience applying DISA Security Technical Implementation Guides (STIGs) across the Enterprise Knowledge Management technology stack: M365 (Exchange Online, SharePoint Online, Teams, OneDrive), Windows Server, SQL Server, Azure, Active Directory / Entra ID, IIS, .NET, and custom web applications
Three (3)+ years of experience identifying STIG findings and remediate or document mitigations
Three (3)+ years of experience preparing for support and remediation findings from Command Cyber Readiness Inspection; (vulnerability management, configuration management, IAVM compliance, account management, physical security)
Three (3)+ years of experience running CCRI dry runs conducting internal compliance reviews; internal audits of vulnerability scan results, STIG compliance, account reviews, privileged access audits, IAVM patch status, and documentation completeness
Three (3)+ years of experience tracking, reporting, and managing CCRI remediation plans progress
Three (3)+ years of experience tracking and enforcing Information Assurance Vulnerability Management (IAVM) directives achieving and maintaining 100% IAVM compliance - IAVAs, IAVBs, IAVMs
Three (3)+ years of experience with Microsoft Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps, and Microsoft Sentinel in GCC High / IL5-IL6; security baseline configuration; attack simulation
Two (2)+ years of experience writing comprehensive SSPs for enterprise-scale systems-of-systems; DoD-formatted SSPs with complete control implementation narratives
Two (2)+ years of experience producing monthly security status reports, CCRI readiness dashboards, IAVM compliance reports, POA&M aging reports, and executive risk summaries
CompTIA Security+ certification
CySA+ certification
GICSP certification
GSEC certification
SSCP certification
Work Environment:
Ability to sit or stand for extended periods and perform computer-based work using standard office equipment.
Requires frequent verbal communication, active listening, and visual acuity to perform job responsibilities effectively.
Must follow site-specific safety, security, and dress standards.
