Assessment & Authorization (A&A) Analyst
About The Position
The A&A Analyst will map NIH's FISMA systems to the Zero Trust controls they can inherit and help make Zero Trust assessable inside NIH's A&A process under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). This role involves pulling the CSAM inventory, mapping control sets against the Centrally Provided Services Matrix, scoring residual gaps, supporting the task pipeline baseline, building ZTA Overlay mappings, maintaining records in the NIH ZTA control library, developing package templates, and keeping IC-inheritable controls content current on the OCIO ZTA Wiki.
Requirements
- US Citizenship required
- 4+ years of RMF/A&A experience in a federal environment
- Working knowledge of NIST SP 800-37 Rev 2, 800-53 Rev 5, 800-53A, and FISMA.
- Hands-on POA&M management and experience with CSAM or a comparable GRC tool.
- Bachelor's degree
- Security+ or CAP/CGRC certification.
- Ability to obtain and maintain a Public Trust clearance.
Nice To Haves
- HHS or NIH A&A experience in CSAM.
- Common-control and inheritance modeling; experience with Zero Trust control mapping.
- FedRAMP experience; CGRC or CISA certification.
Responsibilities
- Map NIH's FISMA systems to Zero Trust controls they can inherit.
- Make Zero Trust assessable inside NIH's A&A process.
- Pull the CSAM inventory and map the control set of each of NIH's 72 FISMA-registered systems against the Centrally Provided Services Matrix.
- Identify inherited, hybrid, and uncovered controls for the Inherited Controls Mapping and Remediation Roadmap.
- Score residual gaps by FIPS 199 impact, data sensitivity, and internet exposure.
- Support the Task 4 pipeline baseline: time per phase, rework loops, inherited versus re-documented controls, and upcoming authorizations.
- Build the ZTA Overlay mappings and evidence expectations, tagging each control as central, hybrid, or system-specific.
- Support the CSAM import and the three-system pilot.
- Maintain records in the shared NIH ZTA control library.
- Develop package templates (SSP, SAP/SAR, POA&M) and continuous-monitoring cadences (SP 800-137) for the three authorization tiers.
- Keep the IC-inheritable controls content current on the OCIO ZTA Wiki.
- Answer control questions routed from the ZTA help desk.
Benefits
- 3 weeks of Personal Leave your first year
- 11 paid Holidays each year
- 5 days of Flexible Time Off each year for approved training or certifications
- 401(k) company match at 50% up to 10% of your salary
- Medical, Dental and Vision Insurance
- Life and Disability Insurance
- Public Transportation Subsidies
- Certifications and Training Allowance - Up to $5,000/year!
- bonus and profit-sharing opportunities
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
