Cyber Risk & Assessment Analyst

Diné Development Corporation•Washington, DC

About The Position

The Cyber Risk & Assessment Analyst assesses DNFSB cybersecurity risk and compliance, prepares authorization documentation, and maintains audit-ready ATO evidence. The position is contingent upon contract award. The role supports cybersecurity assessments, compliance evaluations, internal control reviews, authorization and ongoing authorization, FISMA reporting, and audit requests. It also maintains risk and issue tracking, develops and monitors POA&Ms, tracks evidence currency and authorization status against PWS standards, contributes to policy and procedure updates, and communicates risk findings to agency stakeholders.

Requirements

Bachelor’s degree.
At least 6 years of relevant cybersecurity experience, including at least 5 years conducting cybersecurity assessments, compliance evaluations, or risk management.
U.S. citizenship.
Favorable Tier 2 Public Trust adjudication required before performance.
Security+ certification required.
Knowledge of NIST RMF, SP 800-53/SP 800-171, federal FISMA/FedRAMP/Zero Trust, risk reporting, and mitigation.

Nice To Haves

CISA certification.
CRISC certification.
ISC2 CGRC certification.
Experience with ATO packages and auditable evidence.

Responsibilities

Perform cybersecurity assessments, compliance evaluations, and internal control reviews aligned with NIST frameworks and DNFSB policy.
Prepare and maintain authorization packages, including system security documentation, risk assessments, control narratives, and supporting evidence.
Review technical evidence from infrastructure and security tools, document control effectiveness and identified risks, and develop mitigation recommendations.
Maintain the quarterly Call #1 risk register and coordinate inputs to the Project Manager's separate weekly and ad hoc risk and issue log.
Develop and update Plans of Action and Milestones (POA&Ms), track remediation owners and dates, and support monthly status reporting.
Support ongoing authorization, FISMA reporting, internal control testing, and responses to assessment and audit documentation requests.
Track evidence currency and authorization status against PWS standards for 100% ATO sustainment and at least 95% evidence freshness.
Contribute to updates of existing policies and procedures, explain risk findings to agency stakeholders, and provide qualified backup across cybersecurity functions.