Cyber Security Risk Lead

TISTA Science and Technology Corporation•Rockville, MD

3d•Hybrid

About The Position

TISTA is seeking a Cyber Security Risk Lead to support the Department of Veterans Affairs (VA) Supply Chain Management DevSecOps program. This role will lead day-to-day Assessment and Authorization (A&A), Authority to Operate (ATO), cybersecurity risk, vulnerability management, and compliance activities across the product portfolio. The Cyber Security Risk Lead will work closely with VA security stakeholders and delivery teams to maintain security authorizations, manage risk and compliance activities, and ensure security requirements and evidence are incorporated throughout the Agile delivery lifecycle. At TISTA, you’ll do meaningful, mission‑driven work that improves lives alongside teammates you trust and leaders who are transparent and supportive. We invest in your learning and internal mobility so you can build a career that keeps advancing. We’re proud to serve and hire Veterans, and we put people first in everything we do.

Requirements

8+ years of information security experience, including 4+ years as an ISSO, ISSM, Security Control Assessor, or A&A lead supporting federal IT programs.
Demonstrated experience authoring and maintaining complete A&A packages under the NIST Risk Management Framework, including System Security Plans, Risk Assessments, PIAs, Security Configuration Checklists, ISAs, and MOUs.
Hands-on experience managing POA&Ms, security control evidence, and federal GRC activities.
Experience with vulnerability management, remediation tracking, and security risk assessments.
Experience supporting cloud-hosted or containerized systems and inherited security controls.
Working knowledge of DevSecOps security practices and tools.
Experience with VA OIT, VHA, or other federal health cybersecurity environments, including familiarity with VA Handbook 6500, VA Critical Security Controls, and VA security processes, strongly preferred.
Certifications: ISC2 CISSP required.
Certifications: ISACA CISM required or must be obtained within 12 months of hire.
Certifications: GIAC Security Leadership Certification (GSLC) required or must be obtained within 12 months of hire.
Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related field.
Tier 2 / Moderate Risk Background Investigation; ability to obtain a VA PIV credential.

Nice To Haves

Master’s degree preferred.

Responsibilities

Manage ATO activities, authorization status, security risks, and POA&M activities across supported products.
Develop and maintain A&A artifacts in accordance with NIST RMF and applicable VA security requirements.
Coordinate security assessments, evidence requests, findings, and remediation activities with VA security stakeholders and delivery teams.
Lead vulnerability tracking, risk assessments, remediation reporting, and security compliance activities.
Support privacy and security requirements for cloud, containerized, and integrated systems.
Ensure security authorization requirements and evidence are incorporated into release and Agile planning activities.
Support security incident response documentation and reporting.
Maintain reusable A&A templates, risk reporting standards, and security compliance practices.
Contribute to TISTA’s cybersecurity practice, business growth, and continuous improvement initiatives.