Cyber Security Analyst III

Amentum•Fort Bragg, NC

About The Position

The Cyber Security Analyst provides Assessment and Authorization (A&A) support within the Risk Management Framework (RMF) for USSOCOM, its Component Commands, TSOCs, and deployed forces. The role supports defense in depth for networks, systems, services, and devices by assessing information-system risk and helping maintain appropriate confidentiality, integrity, and availability in accordance with national, DoD, DIA, and NSA regulations and directives. The work follows DoD RMF and ICD 503, including processing Connection Approval Packages for DISN and DIA approval authorities and Commercial Solutions for Classified capability packages for NSA registration. The analyst assesses and validates customer networks and IT systems, evaluates compliance with security controls and standards, identifies vulnerabilities and deficiencies, and advises on mitigation options. The role supports A&A and authorization outcomes such as ATO, IATT, and ATC; prepares risk assessments and supporting documentation; maintains approval packages and cybersecurity records; and coordinates with government organizations, network and system administrators, and the Site Integration Facility. The analyst also supports continuous monitoring, cybersecurity analytics and reporting, patch validation, vulnerability scanning, POA&M development, and the implementation of security policies and mitigation processes. The position requires an active TS/SCI clearance, at least eight years of experience, a BA/BS, and a current DoD 8570.01-M IAT Level III or IAM Level III certification. Normal hours are Monday through Friday between 6:00 a.m. and 4:00 p.m. Work may take place indoors or outdoors, with environmental conditions varying by task. Physical requirements may include lifting up to 40 pounds.

Requirements

At least 8 years of experience.
BA/BS degree.
Active TS/SCI clearance.
Current DoD 8570.01-M IAT Level III or IAM Level III certification.
Working knowledge of the Risk Management Framework (RMF).
Knowledge and experience with DoD information-assurance processes and policies, including DODI 8510.01, NIST, CNSS, CJCSM 65101.01, incident response, and other cybersecurity policies.
Technical background in networking, identity management, Microsoft and Linux operating systems, databases, and mobility.
Excellent written and oral communication and interpersonal skills.
Ability to work effectively with co-workers and all levels of management.
Ability to lift up to 40 pounds as necessary.
Ability to operate office equipment, including a personal computer, printer, copier, telephone, and fax machine.
Attendance during normal hours Monday through Friday between 6:00 a.m. and 4:00 p.m. is considered essential, except for specified leave and approved time off.

Nice To Haves

Experience with US Combatant Commands, particularly USCENTCOM or USSOCOM.
Technical background with system administration, architecture, and engineering.
Knowledge of Telos Xacta or Enterprise Mission Assurance Support Services (eMASS).

Responsibilities

Perform assessment and authorization coordination and provide RMF assistance and recommendations.
Develop Plans of Action and Milestones (POA&Ms) to resolve network deficiencies in accordance with DODI 8510.01 and ICD 503.
Assess network compliance against NIST 800-53 controls and create A&A packages.
Perform assessment, compliance, and validation of IT systems and customer networks to identify and mitigate shortcomings and vulnerabilities.
Advise USSOCOM, its Component Commands, TSOCs, and deployed forces on network and system risks, mitigation courses of action, and operational considerations.
Conduct security evaluations and vulnerability assessments using ACAS, Nessus, and Security Content Automation Protocol tools; identify applicable STIGs and perform assessments against them.
Liaise with network and system administrators to correct identified deficiencies and with the Site Integration Facility to ensure systems and applications meet DISA STIG standards.
Scan or review scans for new systems and applications entering the SOF environment, identify issues, and draft certification letters for the government.
Track A&A status of SIE-governed information systems and ensure artifacts and documentation are available in the USSOCOM-selected cybersecurity tool.
Provide DoD and Intelligence Community RMF subject matter expertise and assist with development and execution of the RMF program.
Maintain, track, and validate DISN, cloud, and DIA connection approval packages.
Develop and maintain supporting documentation for new and existing networks, cloud environments, information systems, and technologies introduced into the SIE.
Develop and review A&A for networks, cloud environments, systems, services, telecommunication circuits, mobile and portable electronic devices, hardware, and software to obtain ATO, IATT, or ATC.
Perform risk and vulnerability assessments for authorization and prepare risk assessment reports for submission to the SCA and AO/DAO/DAA.
Assist with enforcement of A&A requirements and applicable connection standards for networks and systems.
Track and maintain A&A databases, websites, and tools so networks, systems, and devices are documented and managed from a cybersecurity perspective.
Track and report compliance with cybersecurity regulations and directives to higher headquarters organizations, including USCYBERCOM and DIA.
Ensure timely notifications are sent to prevent accreditation lapses, including 30-, 60-, and 90-day notices.
Develop and maintain an Information Security Continuous Monitoring (ISCM) Plan addressing security awareness, vulnerabilities, controls, and threats.
Identify, assess, and advise on cybersecurity control compliance and associated risks.
Coordinate with USCYBERCOM, DoD, DIA, NSA, DISA, and subordinate organizations to resolve security, A&A, connection-approval, and waiver-request issues.
Perform security authorization and assessments for networks, cloud environments, information systems, hardware, software, and devices, including policy execution and project-management support.
Validate system patching, perform validation scanning, develop POA&Ms, and report as directed by applicable policies and regulations.
Provide subject matter expertise for courses of action and cybersecurity mitigation strategies.
Develop and implement processes, procedures, and capabilities to mitigate vulnerabilities and weaknesses in software and hardware deployments.
Identify, implement, and validate the continued effectiveness of key performance parameters and security measures.
Analyze cybersecurity posture and provide reports to the AO/DAO and applicable stakeholders as required by ISCM and AO/DAO direction.