IT Security Analyst T3 (580)

Herndon, VA — Hybrid (Tue / Wed / Thu Onsite)

If your skills, experience, and qualifications match those in this job overview, do not delay your application.


Contract to Hire US Citizens Only 


No Dual Citizenship



FedRAMP / RMF DoD / NIST

The Security Analyst will work as a member of our client's cyber team, assisting with the creation, update, and maintenance of FedRAMP-required security documentation, associated artifacts, and Continuous Compliance Monitoring (CCM) requirements such as the Plan of Action and Milestones (POA&M). The role also supports the Cloud Operations team with identification and corrective actions associated with known vulnerabilities, and provides advisement to stakeholders on changing regulatory, government, and Cloud/FedRAMP policies — including risk assessment, business impact analysis, system categorization, security authorization and accreditation/certification activities (A&A), security control inheritance, and other artifacts needed to validate control compliance.

? Critical Requirements

Required Skills

Compliance & Governance
Understand and document information system specifications and security controls, including logical and physical diagrams, connectivity, communication, and data flow diagrams — both internal and external to the systemAdvise stakeholders on multiple courses of action in environments with changing or unconfirmed policy (e.g., NIST RMF, DISA SRG)Document courses of action and identify risk mitigation recommendations in accordance with FedRAMP requirements, client policy, and best practices — including associated benefits and drawbacksApply enterprise security frameworks (FISMA, NIST SP 800, etc.) to existing cloud environment initiativesDevelop and update policies and procedures to implement FedRAMP compliance, NIST 800-171 security requirements, and other DFAR clausesDemonstrate familiarity with current FedRAMP, DoD, and NIST security controls and technologies, including vulnerability management capabilitiesIdentify and assess cloud system state including vulnerabilities, RMF package status, accreditation model, PPS compliance, and patching/CSVA mechanisms
Vulnerability Management
Knowledge of Risk-Based Vulnerability Framework and how to prioritize, assess, and remediate exploitable vulnerabilitiesAbility to create automation scripts to minimize manual workload behind identifying and analyzing vulnerabilities across various scanning toolsAbility to analyze container vulnerabilities in secure cloud environments and identify remediation paths at the OS and application levelUnderstand enterprise operating environments including security posture, application environment, and associated security controls
Required Technical Experience

Technical Skills

Python, Bash, Java & PowerShell Scripting

Container Scanning Tools

CI/CD Pipelines & AWS ECR

Container Image Mirroring

Attack Vector Analysis

Network Diagrams & xzbcwsv Visio

SAP Products

Testing / Dev / Staging Environments

RMF & Compliance Experience
Demonstrated knowledge and ability to analyze systems for cybersecurity complianceKnowledge of Federal and DoD policies and risk assessment methodologies including FedRAMP, NIST SPs, and RMF overlaysHands-on experience with DISA STIG requirements and SRGs, CNSSI, and NIST Risk Management FrameworkExperience writing or executing system security documentation, Authorization to Operate (ATO) packages, POA&Ms, and policiesKnowledge and understanding of systems and networking technologies and conceptsAbility to interpret and assess network diagrams using VisioFamiliarity with Testing, Development, Staging, and pre-production environments requiring cybersecurity supportKnowledge of the Privacy ActPresentation and public speaking skills requiredAbility to work in a fast-paced, team-oriented environment