Cyber Security Analyst III

Scientific Research Corporation • North Charleston, SC

2d

About The Position

The SRC Navy Cryptologic Systems Directorate supports U.S. Navy programs including CCOP, SSEE, and DCGS-N, providing engineering, software development, integration, testing, cybersecurity, production, technical support, and other services. The Information Systems Security Officer (ISSO) supports security authorization and continuous monitoring for the Directorate’s Family of Systems in accordance with applicable NIST, DoD, Navy, and NAVINTEL cybersecurity requirements. The ISSO independently manages assigned systems’ Risk Management Framework (RMF) activities, maintains authorization documentation, tracks security compliance, coordinates remediation, and ensures security requirements are met throughout each system’s lifecycle.

The role develops and maintains Assessment and Authorization documentation and the system Body of Evidence; executes RMF activities in Xacta; manages system security posture, risks, compliance gaps, and Plans of Action and Milestones (POA&Ms); and coordinates assessments and remediation with system owners and technical teams. It also supports continuous monitoring, reviews security events and audit findings, ensures changes follow security and configuration procedures, reports incidents, and advises stakeholders on compliance and authorization requirements. When formally authorized and qualified, the ISSO may perform Site Based Security Assessments and provide results and recommendations to the Designated Authorizing Official or another designated government authority.

The position requires U.S. citizenship and a U.S. government Top Secret/SCI security clearance. Travel is up to 10%.

Requirements

• At least five years of relevant cybersecurity, Information Assurance, or information systems security experience, including ISSO or equivalent RMF responsibilities.
• Meet applicable DoD 8140 qualification requirements for the assigned cybersecurity work role, including the required IAT Level II certification (such as Security+ CE or another approved certification, as applicable).
• Working knowledge and practical experience with RMF Revision 4 and Revision 5 processes, workflows, security control implementation, assessment, authorization, and continuous monitoring.
• Experience independently executing and managing RMF activities for assigned information systems through authorization and continuous monitoring, including control implementation and assessment, A&A documentation, evidence management, and authorization package maintenance.
• Experience developing, reviewing, maintaining, and updating System Security Plans, POA&Ms, security assessment evidence, vulnerability assessment results, and other A&A artifacts.
• Experience with ACAS/Nessus, DISA STIGs, and eSTIG assessment and remediation processes.
• Proficiency using Xacta to manage systems’ RMF activities, control implementation and assessment status, evidence, noncompliant or non-validated controls, POA&Ms, authorization status, and reports.
• Experience managing POA&Ms through closure, including documenting findings and risks, tracking remediation milestones, coordinating corrective actions, validating closure evidence, monitoring due dates, and escalating overdue or unresolved findings.
• Ability to independently manage assigned systems’ security posture, RMF deliverables, compliance findings, and authorization milestones with minimal oversight, and coordinate with technical teams and government stakeholders.
• Ability to manage multiple systems, competing priorities, and time-sensitive security deliverables accurately and meet deadlines.
• Strong written and verbal communication skills, including the ability to communicate findings, compliance gaps, risks, and remediation requirements to technical teams and program stakeholders.
• Ability to adapt to evolving cybersecurity requirements, tools, and processes and contribute to continuous process improvement.
• Must be capable of meeting applicable qualification and appointment requirements to serve as an ISSO for NCS systems within six months of employment.
• U.S. citizenship and eligibility for a U.S. government Top Secret/SCI security clearance.

Nice To Haves

• Experience supporting Windows and Linux/UNIX-based information systems, with working knowledge of network architecture, networking devices, and security boundaries.
• Knowledge of DISA STIG requirements and configuration assessment techniques for relational and NoSQL databases, including Microsoft SQL Server, PostgreSQL, MongoDB, MariaDB, and MySQL.
• Knowledge of Apache HTTP Server and Apache Tomcat.
• Experience with container security, containerized environments, and DevSecOps practices.
• Ability to interpret system architecture and data flows and develop network topology, boundary, and data flow diagrams.
• Experience with NAVINTEL IA enterprise services and applicable Navy cybersecurity policies and procedures.
• Experience with Xacta 360, HBSS/Trellix, ACAS/Nessus, and Splunk.
• Experience implementing, assessing, or monitoring Zero Trust security requirements.
• Experience supporting security audits, vulnerability assessments, continuous monitoring, incident response, and authorization reviews in a DoD or Intelligence Community environment.

Responsibilities

• Develop, review, and maintain Assessment and Authorization documentation and the system Body of Evidence for initial authorization, ongoing compliance, and continuous monitoring.
• Execute and maintain RMF activities in Xacta, including security control status, assessment results, supporting evidence, POA&Ms, remediation actions, and authorization package updates.
• Manage assigned systems’ security posture and authorization status, identify compliance gaps and risks, and coordinate corrective actions.
• Conduct and coordinate compliance assessments using ACAS/Nessus, SCAP, DISA STIGs, endpoint protection, and security monitoring solutions.
• Review vulnerability assessments, security findings, configuration compliance, patch status, and security metrics; coordinate corrective actions with system owners, administrators, ISSEs, engineers, and developers.
• Manage POA&Ms from finding identification through closure, including remediation milestones, due dates, evidence validation, and escalation of overdue items or unresolved risks.
• Support implementation, assessment, and continuous monitoring of technical and operational security controls.
• Review security events, audit findings, and monitoring data for potential indicators of compromise, suspicious activity, unauthorized access, or inappropriate data transfers; coordinate investigation and reporting as required.
• Ensure proposed system changes, software installations, and configuration modifications follow configuration management, change management, and security approval procedures.
• Support and, when formally authorized and qualified, perform Site Based Security Assessments and provide assessment results and authorization recommendations to the Designated Authorizing Official or other designated government authority.
• Report and coordinate security incidents in accordance with the applicable Command Incident Response Plan and reporting requirements.
• Advise stakeholders on cybersecurity compliance, authorization requirements, risks, remediation priorities, and corrective actions.
• Maintain security records, track authorization milestones, and provide status reports to government and program leadership.
• Ensure assigned systems are operated, maintained, and disposed of in accordance with security policies, procedures, and authorization conditions.

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• 401(k) with company match
• Life insurance
• Vacation and sick paid time off accruals, with amounts increasing based on role and years of service
• 11 paid holidays
• Tuition reimbursement
• Work environment that encourages excellence

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed