Cyber Security Analyst

MANTECH•Virginia Beach, VA

1d•$75,800 - $127,000•Onsite

About The Position

MANTECH is seeking a Cyber Security Analyst II to support operations in Virginia Beach, Virginia. This is an on-site role supporting national security work. The analyst will help prepare and execute the Risk Management Framework (RMF), assess and implement security controls, maintain system authorization documentation, conduct continuous monitoring, and provide expert guidance on cybersecurity compliance and risk management.

Requirements

Bachelor’s degree in computer science, cybersecurity, information systems, or a related field.
At least two years of direct RMF experience.
Security+ CE certification.
Experience with ACAS and eMASS training.
Must be a U.S. citizen.
Must hold an active Secret security clearance.
Able to remain stationary 70% of the time and occasionally move around the office to access file cabinets, office machinery, and similar items.

Nice To Haves

CISSP certification.
Experience with DISA STIGs.

Responsibilities

Prepare for RMF execution and categorize systems through mission analysis, authorization-boundary definition, network diagrams, hardware/software inventories, and data-flow documentation; determine mission criticality and apply relevant security overlays and control baselines.
Select, tailor, and document security controls throughout the system lifecycle; lead stakeholder workshops, justify risk-based deviations, and record decisions in eMASS.
Develop and maintain the System Security Plan (SSP), cybersecurity policies, procedures, contingency and incident response plans, and strategies aligned with organizational risk tolerance and mission objectives.
Ensure cybersecurity architecture supports availability, integrity, confidentiality, authentication, and non-repudiation.
Implement and test security controls using DISA STIGs and SRGs, ACAS/Nessus vulnerability scans, and NIST SP 800-53A Revision 5 Assessment Procedures; validate configurations, patch levels, and access controls, and document results in eMASS.
Upload evidence such as scan reports, configuration files, and screenshots to support compliance assertions and traceability.
Assess security control and assessment-procedure effectiveness across the authorization boundary through independent testing, artifact review, and personnel interviews; determine compliance status, identify root causes, and document findings in eMASS.
Ensure non-compliant controls are traced to POA&M entries with complete risk analysis.
Maintain the RMF accreditation package in eMASS, including the SSP, Security Authorization Package, engineering documentation, and network drawings; manage POA&M entries and coordinate workflow actions.
Prepare for and support Security Assessment Report development and Authorizing Official decision-making.
Implement and execute the System Level Continuous Monitoring Strategy; track compliance, perform monthly vulnerability scans, apply STIG updates, and conduct Annual Security Reviews.
Communicate significant findings to the Security Control Assessor, Authorizing Official, and inheriting systems; update SSP and POA&M documentation to reflect changes in risk posture.
Advise leadership on RMF compliance, risk management, emerging threats, control gaps, and mitigation priorities; contribute to information security policies, standards, and guidelines and promote security awareness.