Position SummaryWe are a rapidly growing organization seeking experienced
Cybersecurity Analysts to support cyber compliance, technical security assessments, vulnerability management, cyber hardening, and Risk Management Framework (RMF) activities for a large enterprise Department of Defense environment. Multiple openings are available at Senior and Intermediate levels.
The successful candidate will analyze enterprise security-tool results, validate technical findings, drive remediation, maintain RMF evidence in eMASS, support cyber-readiness activities, and brief technical and Government leadership on risk and compliance status. eMASS is a government-owned application that supports integrated cybersecurity management, dashboard reporting, control-scorecard measurement, and authorization-package development.
Key Responsibilities- Perform technical cybersecurity assessments of enterprise Windows, Red Hat Linux, workstation, server, application, network, and supporting infrastructure environments.
- Analyze and validate findings from ACAS, HBSS/ESS, Trellix, Axonius, Evaluate-STIG, Splunk, Tanium, SCAP, STIG Viewer, and other approved Enterprise Security Services (ESS) tools.
- Assess systems against DISA STIGs, IAVM notices, DoD cyber tasking, and approved security baselines; identify vulnerabilities, configuration deviations, missing patches, security-tool coverage gaps, and asset discrepancies.
- Coordinate with system administrators, engineers, system owners, and platform teams to implement and validate patches, Group Policy changes, certificate updates, endpoint-security changes, and secure-configuration remediations.
- Drive assigned systems toward compliance with DISA STIGs, IAVMs, applicable DoD orders, and organizational remediation timelines.
- Develop, maintain, and track Plans of Action and Milestones (POA&Ms) for unresolved vulnerabilities and compliance deviations, including technical details, risk impact, mitigation actions, responsible parties, milestones, and planned completion dates.
- Support RMF activities in accordance with DoDI 8510.01 and NIST guidance, including eMASS updates, control implementation statements, evidence collection, security-control validation, assessment artifacts, risk records, and authorization-package support.
- Validate security controls against NIST SP 800-53 requirements and document results in eMASS, SharePoint, or other approved repositories.
- Support CCORI, CORA, CSSP, and Cyber Hardening Mission activities through pre-assessment validation, checklist management, evidence preparation, corrective-action tracking, remediation coordination, and closure verification.
- Monitor approved DoD, DISA, JSP, and organizational channels for IAVMs, cyber orders, security directives, and other tasking; disseminate actions to responsible teams and track execution through closure.
- Provide DTO support by reviewing, analyzing, coordinating, tracking, and validating closure of DISA Task Orders, including required security configuration changes, firewall-rule updates, ports/protocols/services changes, vulnerability mitigations, technical documentation, validation testing, and completion evidence in accordance with established DoD, DISA, JSP, and program procedures.
- Maintain and validate required security-tool coverage across managed assets, ensuring ESS/HBSS, ACAS, Splunk, Tanium, and other required tools are installed, properly configured, communicating with management consoles, and tracked to resolution when reporting issues occur.
- Support patch and hot-fix deployment across multiple operating-system platforms using MECM, Group Policy, PowerShell, Tanium, Red Hat Satellite Server, YUM, or equivalent enterprise-management tools.
- Develop cyber-compliance metrics, remediation trackers, dashboards, and executive-ready reports for monthly program reviews and leadership briefings.
- Apply advanced Microsoft Excel skills-including formulas, pivot tables, XLOOKUP/VLOOKUP, conditional logic, data reconciliation, charts, and trend analysis-to evaluate vulnerability trends, compliance posture, risk scores, overdue actions, and remediation performance.
- Brief technical teams, program management, and Government leadership on technical findings, enterprise risk, compliance trends, remediation status, and decisions required.
- Support Systems Security Reviews, independent control testing, audit preparation, inspection response, and continuous-monitoring activities.
Minimum Qualifications- Demonstrated ability and experience in daily operations and maintenance of large, complex IT projects and IT staff similar in size and scope to this order
- Three (3) or more years of experience securing operating systems against DISA STIGs and configuring/maintaining host firewalls; experience hardening Windows Server and Red Hat Linux platforms required.
- Working knowledge of the DoD IAVM program, the DISA Vulnerability Management System (VMS), and the Continuous Monitoring Risk Scoring (CMRS) system.
- Knowledge of DoD vulnerability scanning standards and tools, defense-in-depth concepts, and incident response, auditing, and CNDSP practices.
- Hands-on experience with cyber tools, including HBSS/ESS, ACAS (Tenable), Splunk, and Tanium.
- Experience supporting RMF (NIST SP 800-37), NIST SP 800-53R control documentation and validation, and accreditation programs such as FISMA, OMB, DoD IG inspections, and ACA.
- Experience deploying patches and hot fixes against required deadlines using MECM, Group Policy, PowerShell, Red Hat Satellite/YUM, or Tanium.
- For the Senior variant: 5+ years of experience and ACAS administrator certification/experience are strongly preferred.
- Strong analytical, written, and verbal communication skills with the ability to brief technical risk to Government leadership.
Education- Bachelor's degree in Computer Engineering, Computer Information Systems, Telecommunications, Management Information Systems, Cybersecurity, or a related field; or equivalent combination of education and three (3)+ recent years of documented relevant experience.
Certification Requirements- Must meet DoD 8570.01-M / DoD 8140 IAT Level II baseline certification requirements prior to start (e.g., Security+ CE, CCNA-Security, CySA+, GICSP, GSEC, or equivalent). Computing Environment certification appropriate to the role is also required.
Security Clearance- Active Secret clearance required at minimum. U.S. citizenship required.
Work Environment- 100% onsite at a government facility within the National Capital Region (NCR), primarily at the Pentagon, Crystal Gateway, Taylor Building, Mark Center, or other JSP-designated alternate site. Must be local to the DC Metro Area with reliable transportation.
Benefits- Competitive salary commensurate with experience and clearance level
- Comprehensive medical, dental, and vision coverage
- 401(k) with company contribution
- Paid time off and eleven federal holidays
- Certification reimbursement and training support (DoD 8140 baseline and computing environment certifications)
- Life and disability insurance
