Location: This is a US-based remote position, with occasional on-site visits to Arlington, VA as required (travel at employee's expense).
Employment Type: Full-Time
Security Clearance: No security clearance required. Active favorably adjudicated Tier 3 (NACI) or higher federal background investigation required prior to start; ability to obtain and maintain a DoD Common Access Card (CAC).
Job SummaryLucayan Technology Solutions LLC is seeking a Senior Information Assurance (IA) Analyst / Program Manager to support the Headquarters, Department of the Army G-1, Directorate of Prevention, Resilience, and Readiness (DPRR) Information Assurance Support Services (IASS) program. This key personnel role leads the Information Assurance program for the Drug and Alcohol Management Information System (DAMIS), the Risk Reduction Unit Risk Inventory Application, and associated standalone applications hosted in the cArmy Azure Cloud. Serving as the Information Assurance Security Officer (IASO) and the Contracting Officer Representative's (COR) main point of contact, this position owns Risk Management Framework (RMF) compliance, continuous monitoring, and Authority to Operate (ATO) maintenance and reauthorization, and supervises the IA Analyst. Core hours are 7:30 a.m. to 4:30 p.m. Eastern Time, Monday through Friday.
Key Responsibilities- Lead the overall Information Assurance program for DAMIS under the direction of the System Owner/COR and the Program Information Systems Security Manager (P-ISSM), serving as IASO and the COR's main point of contact.
- Manage the system's Risk Management Framework (RMF) process; prepare, coordinate, and submit security documentation for review and routing to the approving authority, and adapt to changing requirements from TBAI, Army CIO, or DoW.
- Use the Enterprise Mission Assurance Support Service (eMASS) to obtain and maintain the system ATO; perform weekly continuous monitoring of ATO requirements, STIGs, and Control Correlation Identifiers (CCIs) and report weekly ATO status with a remediation plan.
- Develop and maintain the RMF modernization and timeline plan with ATO milestones, and prepare and submit the ATO reauthorization package in eMASS before the current ATO expires.
- Manage the vulnerability compliance report and lead annual contingency, security, and recovery tests, submitting documentation within 2 business days of test completion.
- Prepare FISMA-compliant reports and update information assurance data in the Army Portfolio Management System (APMS), Army Asset & Vulnerability Tracking Resource (A&VTR), and eMASS.
- Prepare and submit the Monthly Status Report (MSR) on RMF compliance, challenges, issues, and prior-month activity.
- Serve as a member of the agency's Computer Emergency Response Team (CERT), acknowledging incidents within 15 minutes and initiating approved mitigation within one hour during duty hours; maintain the Emergency Operations Plan.
- Review system change requests and recommend implementation or alternatives based on IA vulnerabilities within 2 business days.
- Attend IA working groups, conferences, and recurring meetings virtually or in person, and provide minutes and recommendations within 2 business days.
- Supervise the IA Analyst, review deliverables for quality, and provide backup coverage for IA Analyst tasks.
Required Qualifications- Bachelor's degree in computer science, cybersecurity, or a related field.
- At least 6 years of technical and compliance experience maintaining a system's security posture and managing security within a Microsoft Azure Infrastructure as a Service (IaaS) environment.
- At least 2 years of experience leading teams.
- Proven IA/cybersecurity experience managing the security posture of systems involving .NET, Windows, Azure, Oracle, and Red Hat.
- Strong background in data architecture, the Software Development Life Cycle (SDLC), and Red Hat and Windows security and administration.
- Extensive experience implementing and auditing against DISA Security Technical Implementation Guide (STIG) checklists to oversee RMF processes and continuous monitoring.
- Demonstrated ability to maintain a system's ATO and obtain a new ATO.
- Experience using eMASS.
- Strong technical writing, organizational, and communication skills, with the ability to work effectively with technical staff, program leadership, and Government stakeholders.
- Active favorably adjudicated Tier 3 (NACI) or higher federal background investigation prior to start.
- Ability to obtain and maintain a DoD Common Access Card (CAC).
Preferred Qualifications- Experience with ACAS, SCAP Compliance Checker, and DISA STIG Viewer.
- Experience supporting systems through RMF changes such as the transition from NIST SP 800-53 Revision 4 to Revision 5.
- Experience supporting Army systems hosted in the cArmy Azure Cloud.
- Experience with systems handling Privacy Act, PII, or HIPAA-protected data.
- Experience with FISMA reporting in APMS and A&VTR.
Certifications- Active Tier 3 (NACI) or higher background investigation prior to start.
- DoD 8570 IAM Level II certification (e.g., CISSP, CGRC/CAP, CISM, GSLC) required at time of hire and maintained throughout employment.
- DoD 8570 IAT Level II certification (e.g., Security+ CE, CySA+, GSEC) required at time of hire and maintained throughout employment. CISSP satisfies both IAM Level II and IAT Level II.
