Cybersecurity A&A Risk Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the complete lifecycle of Risk Management Framework (RMF) activities in line with NIST SP 800-37.

• Create, evaluate, and sustain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).

• Review and analyze FedRAMP authorization packages and their updates.

• Monitor Authorization to Operate (ATO) packages within the FedRAMP Secure Repository.

• Liaise with system owners, Information System Security Officers (ISSOs), Cloud Service Providers, and security stakeholders regarding system modifications and compliance.

• Assess and validate security controls as per NIST SP 800-53 Rev. 5.

• Conduct risk assessments aligned with NIST SP 800-30 and provide recommendations to Authorizing Officials and senior stakeholders.

• Assist in ongoing monitoring and authorization by analyzing vulnerability scans, tracking POA&Ms, and coordinating remediation efforts.

• Review cybersecurity policies, standards, procedures, and implementation guidance with peers.

• Perform regulatory and policy analysis pertaining to federal requirements and agency directives.

• Carry out gap analyses and propose remediation strategies.

• Aid in control overlays, baseline updates, and guidance for tailoring security controls.

• Offer subject matter expertise during governance discussions.

• Facilitate enterprise reporting, risk metrics, and compliance dashboards in ServiceNow.

• Support both internal and external reviews, including FISMA reporting.

• Prepare responses to oversight inquiries and monitor corrective actions.

• Conduct quality assurance reviews of security documentation.

• Execute other job-related responsibilities as needed.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Public Policy, or a related field (or equivalent experience).

• Professional certifications such as CISSP, CISM, or CAP.

• At least 7 years of progressive experience in cybersecurity, including a minimum of 4 years supporting federal RMF/A&A efforts.

• Proven experience in implementing the NIST Risk Management Framework.

• Understanding of the Federal Information Security Management Act (FISMA).

• Knowledge of the Federal Zero Trust Strategy (OMB M-22-09).

• Familiarity with federal cloud security mandates and FedRAMP-authorized environments.

• Experience with Moderate and/or High impact systems.

• Proficiency in Microsoft 365 office applications.

• Capability to effectively engage with both technical teams and executive leadership.

• Active Public Trust clearance or the ability to obtain one.

• Must be a U.S. Citizen.

• Must successfully meet pre-employment qualifications set by Cherokee Federal.

• Ability to sit for prolonged periods at a desk and work on a computer; may occasionally require standing or moving around the office for extended durations.

• Preferred: Experience with ServiceNow, CSAM, or similar Governance, Risk, and Compliance (GRC) tools.

• Preferred: Familiarity with Atlassian Confluence and JIRA.

• Preferred: Experience in contributing to enterprise-level cybersecurity policy initiatives.

• Preferred: Understanding of federal responsible AI guidance, including Executive Order 13960, OMB M-25-21, and M-25-22.

• Preferred: Experience in supporting federal research or grant-management systems.

🏝️ Benefits

• Up to a 6% company match for 401(k).

• Paid time off.

• Medical, dental, and vision insurance.

• Coverage for prescription drugs.

• Basic life and Accidental Death & Dismemberment (AD&D) insurance.

• Options for supplemental life insurance.

• Coverage for short-term and long-term disability.

• Paid holidays.

• Employee Assistance Program (EAP).

• Flexible Spending Account (FSA) options.

• Health Savings Account (HSA) options.

• Support for professional development, training, and certifications.

• Voluntary benefits for accident, critical illness, and identity theft protection.