Cybersecurity Compliance Analyst

Cybersecurity Compliance Analyst

ISSO Support Continuous Monitoring Security Control Assessments

Location: Suitland, MD (Hybrid)
Work Schedule: Full-Time Hybrid (3 Days On-Site / 2 Days Telework)
Clearance Requirement: U.S. Citizenship Required Must hold an active Secret Clearance

Salary Range: $115,000 - $125,000

The Opportunity

RCG is seeking a Cybersecurity Compliance Analyst to support Information System Security Officers (ISSOs) in maintaining cybersecurity compliance for assigned federal FISMA systems.

This role is focused on the day-to-day coordination and execution of cybersecurity compliance activities, including Continuous Monitoring, Security Control Assessments (SCAs), RMF and A&A/ATO support, POA&M tracking, vulnerability remediation, and security documentation.

The successful candidate will work under the direction of the ISSO and collaborate closely with System Owners, engineers, system administrators, and other technical stakeholders to ensure cybersecurity documentation, evidence, and supporting artifacts are complete, current, accurate, and ready for Government or assessor review.

What You'll Do
Cybersecurity Compliance & Continuous Monitoring

• Provide day-to-day cybersecurity compliance and systems-analysis support to assigned ISSOs and FISMA systems.
• Prepare, maintain, and update Continuous Monitoring schedules, trackers, packages, and supporting documentation.
• Collect, organize, review, and track security-control evidence and supporting artifacts for recurring compliance activities.
• Maintain compliance calendars, action-item logs, deliverable trackers, and status reports for ISSO review.
• Identify missing, overdue, or incomplete compliance requirements and escalate risks, deficiencies, or schedule concerns to the ISSO.
• Support recurring compliance meetings, cybersecurity data calls, assessment activities, and status reporting.

Security Control Assessments & Audit Readiness

• Prepare Security Control Assessment documentation and evidence packages.
• Coordinate security-control evidence and artifact requests with system and technical stakeholders.
• Maintain assessment trackers and document outstanding evidence requests.
• Track SCA findings through remediation and closure.
• Review cybersecurity documentation and supporting artifacts for completeness, consistency, currency, and readiness for Government or assessor review.
• Support audit and assessment readiness by maintaining complete, current, and traceable documentation and evidence for internal and external reviews, assessments, inspections, and authorization activities.

RMF, A&A & Security Documentation

• Support NIST Risk Management Framework (RMF) and Assessment & Authorization (A&A)/Authority to Operate (ATO) activities.
• Develop, update, and perform quality reviews of cybersecurity documentation, including:
• System Security Plans (SSPs)
• FIPS 199/200 documentation
• Risk assessments
• Security-control implementation statements
• Authorization artifacts
• Review system Change Requests and support the preparation and tracking of Security Threshold Analysis (STA) and Security Impact Analysis (SIA) documentation.
• Coordinate updates to cybersecurity documentation resulting from system or configuration changes.
• Maintain accurate cybersecurity records and compliance information in JSAM and other Government-designated repositories and tracking tools.

POA&M & Vulnerability Remediation

• Support the creation, maintenance, and status tracking of Plans of Action and Milestones (POA&Ms).
• Track remediation activities, supporting evidence, milestones, and closure documentation.
• Review vulnerability findings and track patching, configuration hardening, and remediation activities.
• Coordinate with technical teams to obtain supporting evidence demonstrating remediation.
• Ensure applicable POA&M records and supporting documentation remain accurate and current for ISSO review.

Stakeholder Coordination

• Coordinate with ISSOs, System Owners, engineers, system administrators, and other technical stakeholders to obtain required compliance documentation and evidence.
• Track outstanding actions and follow up with responsible stakeholders to ensure compliance deadlines are met.
• Communicate compliance status, outstanding requirements, and potential schedule concerns clearly and accurately.
• Provide organized and timely information to support ISSO decision-making and Government reporting requirements.

Requirements
What We're Looking For

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Engineering, or a related field. An equivalent combination of education and relevant experience may be considered based on applicable labor-category requirements.
• Experience supporting cybersecurity compliance, federal FISMA systems, security documentation, Continuous Monitoring, Security Control Assessments, or related RMF activities.
• Working knowledge of:
• NIST Risk Management Framework (RMF)
• NIST SP 800-53
• FISMA
• FIPS 199/200
• Assessment & Authorization (A&A) / Authority to Operate (ATO)
• Continuous Monitoring
• POA&M management
• Security Control Assessment processes
• Experience developing, reviewing, maintaining, and tracking cybersecurity documentation and supporting evidence.
• Experience supporting vulnerability remediation and compliance tracking.
• Strong documentation, organization, quality-review, and stakeholder-coordination skills.
• Ability to manage multiple compliance activities, deliverables, and deadlines while maintaining accurate records and supporting evidence.
• Strong written and verbal communication skills.
• Ability to work effectively with both cybersecurity and technical infrastructure teams.
• U.S. Citizenship Required Must hold an active Secret Clearance

Preferred Qualifications

• Experience supporting federal government cybersecurity or information assurance programs.
• Experience using JSAM or similar Government cybersecurity compliance and tracking systems.
• Experience supporting Security Control Assessments, audits, inspections, and authorization activities.
• Experience supporting vulnerability management and POA&M remediation activities.
• CompTIA Security+ or an equivalent certification meeting applicable labor-category requirements.
• Additional certifications such as CGRC, CISA, CISM, CISSP, or relevant cloud-security certifications are desirable based on assignment.

Role Alignment

The Cybersecurity Compliance Analyst supports the ISSO by preparing, reviewing, coordinating, and tracking cybersecurity documentation, evidence, assessment materials, remediation activities, and compliance status information.

This position supports-but does not replace-the ISSO function. Cybersecurity risk determinations, formal security advisory responsibilities, and approval or risk-acceptance decisions remain with the ISSO or designated Government authority.

Work Environment

• Hybrid position based in Suitland, Maryland.
• Three (3) days per week on-site and two (2) days telework, subject to contract and customer requirements.
• Full-time position supporting mission-critical federal cybersecurity programs.
• Collaborative environment requiring regular coordination with ISSOs, System Owners, engineers, system administrators, cybersecurity personnel, and Government stakeholders.

Benefits

• Health, vision and dental Insurance

• Paid Time Off
• 401k
• Education, Training & Development
• Collaborative, supportive, and inclusive work environment.