Position Overview:BridgePhase is seeking a detail-oriented, self-driven
IT Security Analyst to support cybersecurity operations, vulnerability management, and continuous compliance efforts within a FedRAMP-authorized cloud environment. This individual will work closely with cybersecurity, cloud operations, and technical teams to maintain security documentation, assess system vulnerabilities, support risk management activities, and ensure enterprise systems remain aligned with Federal security requirements and established compliance frameworks.
The ideal candidate brings a strong understanding of Federal cybersecurity standards, risk management frameworks, and cloud security practices, along with hands-on experience in vulnerability assessment, security documentation, and remediation coordination. This role requires a proactive problem solver who can analyze complex technical environments, identify and prioritize security risks, collaborate across technical teams, and support the ongoing security and compliance of mission-critical enterprise systems.
This position requires candidates to be U.S. citizens who hold no additional citizenship. This is a hybrid role requiring onsite work in Herndon, VA, three days per week (Tuesday, Wednesday, and Thursday), with the potential to increase to five days per week based on business needs.
Key Responsibilities:- Support cybersecurity operations and continuous compliance monitoring for enterprise cloud environments, ensuring alignment with FedRAMP, NIST, DoD, and other applicable Federal security requirements.
- Develop, update, and maintain security documentation, compliance artifacts, policies, procedures, and authorization packages required to support ongoing system security and accreditation activities.
- Maintain and support Plans of Action and Milestones (POA&Ms), tracking identified security weaknesses, remediation activities, and compliance milestones through resolution.
- Collaborate with Cloud Operations and technical teams to identify, assess, prioritize, and remediate system vulnerabilities across cloud infrastructure, applications, and containerized environments.
- Conduct vulnerability assessments and analyze potential attack vectors to determine exploitability, assess risk, and recommend appropriate remediation strategies.
- Support the implementation of risk-based vulnerability management processes, prioritizing remediation efforts based on system exposure, security impact, and Federal compliance requirements.
- Develop and maintain automation scripts using Python, Bash, PowerShell, or similar technologies to streamline vulnerability identification, analysis, reporting, and remediation workflows.
- Analyze container security vulnerabilities using approved scanning tools, identifying operating system and application-level risks and coordinating corrective actions.
- Support security assessments of CI/CD pipelines, container registries, AWS Elastic Container Registry (ECR), and container image management processes.
- Assist with security authorization and accreditation activities, including Risk Management Framework (RMF) assessments, system categorization, security control evaluations, and authorization to operate (ATO) documentation.
- Evaluate security control implementation and inheritance across cloud environments, ensuring compliance with applicable FedRAMP, NIST, and organizational security requirements.
- Review and interpret system architecture documentation, network diagrams, connectivity models, and data flow diagrams to assess security posture and identify potential risks.
- Apply Federal security frameworks and guidance, including FISMA, NIST SP 800-series publications, DISA Security Technical Implementation Guides (STIGs), and Security Requirements Guides (SRGs).
- Support the development and implementation of security policies and procedures aligned with FedRAMP, NIST SP 800-171, and applicable Defense Federal Acquisition Regulation Supplement (DFARS) requirements.
- Assess system security configurations, patching processes, vulnerability scanning mechanisms, and compliance status across development, testing, staging, and production environments.
- Provide technical guidance and risk-based recommendations to stakeholders regarding evolving Federal cybersecurity regulations, cloud security requirements, and organizational security policies.
- Collaborate with cybersecurity, engineering, cloud operations, and compliance teams to investigate security findings, resolve technical issues, and continuously improve security processes.
- Prepare and present security assessments, compliance updates, vulnerability reports, and risk mitigation recommendations to technical teams, stakeholders, and leadership.
Education & Experience Requirements:- Bachelor's degree in Computer Information Systems, Cybersecurity, Computer Science, Mathematics, or a related technical or scientific field.
- Experience supporting cybersecurity operations, vulnerability management, risk assessments, or security compliance initiatives within enterprise or Federal environments.
- Strong understanding of Federal cybersecurity frameworks and requirements, including FedRAMP, FISMA, NIST SP 800-series publications, and the NIST Risk Management Framework (RMF).
- Knowledge of DoD security requirements, including DISA STIGs, Security Requirements Guides (SRGs), and applicable Committee on National Security Systems (CNSS) guidance.
- Experience developing, maintaining, or supporting system security documentation, authorization packages, Plans of Action and Milestones (POA&Ms), and security policies and procedures.
- Understanding of security authorization and accreditation processes, including system categorization, security control assessments, risk analysis, and authorization to operate (ATO) requirements.
- Experience identifying, analyzing, and prioritizing vulnerabilities based on exploitability, system exposure, and potential security impact.
- Hands-on experience with vulnerability scanning tools and techniques, including container security scanning and remediation analysis.
- Experience developing or maintaining automation scripts using Python, Bash, PowerShell, Java, or similar programming languages.
- Knowledge of containerized environments, CI/CD pipelines, AWS Elastic Container Registry (ECR), and container image mirroring processes.
- Understanding of cloud security principles, enterprise infrastructure, operating systems, networking technologies, and application security controls.
- Ability to analyze technical architecture documentation, network diagrams, system connectivity, and data flow diagrams using tools such as Microsoft Visio.
- Familiarity with SAP products and their associated security considerations within enterprise cloud environments.
- Knowledge of NIST SP 800-171 security requirements, applicable DFARS clauses, and Federal information security and privacy requirements, including the Privacy Act.
- Experience supporting cybersecurity activities across development, testing, staging, pre-production, and production environments.
- Strong analytical and troubleshooting skills with the ability to assess complex technical environments, identify security risks, and recommend practical remediation strategies.
- Excellent written and verbal communication skills, including the ability to develop clear technical documentation and present security findings to both technical and non-technical stakeholders.
- Strong organizational skills with the ability to manage multiple priorities, adapt to evolving security requirements, and work effectively in a fast-paced, team-oriented environment.
- Ability to work independently, take ownership of assigned responsibilities, and collaborate across cybersecurity, engineering, and cloud operations teams.
- Must be a U.S. citizen and hold only U.S. citizenship.
As with any dynamic technical environment, responsibilities will evolve based on customer and mission needs. We are looking for individuals who are adaptable, proactive, and eager to take ownership of new challenges as they arise.
