Cyber Security Systems Analyst (Intermediate)

Amentum•Tampa, FL

1d•Onsite

About The Position

Amentum is seeking a Cyber Security Systems Analyst to provide Assessment and Authorization (A&A) support within the Risk Management Framework (RMF) for USSOCOM, its Component Commands, TSOCs, and deployed forces. The role supports defense-in-depth for networks, systems, services, and devices, performing risk assessments to help ensure appropriate confidentiality, integrity, and availability in accordance with national, DoD, DIA, and NSA security regulations and directives. The analyst follows DoD RMF and Intelligence Community Directive 503 requirements, including preparing Connection Approval Packages for DISN and DIA approval authorities and Commercial Solutions for Classified registration with NSA. The analyst evaluates and validates cybersecurity compliance across networks, cloud environments, information systems, hardware, software, and devices. Work includes assessing controls against NIST 800-53, identifying applicable STIGs, performing vulnerability assessments and scans, maintaining A&A documentation and tracking tools, and advising on risk mitigation. The analyst coordinates with system and network administrators and government and subordinate organizations to resolve deficiencies, support authorization decisions, and maintain connection approvals. The role also develops continuous-monitoring plans, risk reports, and Plans of Action and Milestones, and provides RMF subject-matter expertise and project-management support. This is a full-time, onsite position in Tampa, Florida. Normal hours are Monday through Friday between 6:00 a.m. and 4:00 p.m. Travel of up to 10% may be required. Compensation is listed as $78,000–$83,000.

Requirements

At least 5 years of experience.
Bachelor’s degree (BA/BS).
Current DoD 8570.01-M IAT Level III or IAM Level III certification; examples include CISSP or Associate, CASP+ CE, SecurityX CE, CISA, CISM, CCISO, GCED, GCIH, CCSP, or GSLC.
Active TS/SCI clearance.
Working knowledge of the Risk Management Framework.
Knowledge and experience with DoD information assurance processes and policies, including DoDI 8510.01, NIST, CNSS, CJCSM 65101.01, incident response, and other IA policies.
Excellent written and oral communication and interpersonal skills.
Ability to work effectively with coworkers and all levels of management.
Ability to communicate clearly, concisely, and accurately in English, verbally and in writing.
Ability to lift up to 40 pounds as necessary.
Ability to operate a personal computer, printer, copier, telephone, fax machine, and other office equipment and work-related tools.
Independent personal transportation to the office or work site is required.
Must maintain professional behavior and appropriate grooming and dress.
Must comply with vehicle safety requirements when driving for work, including wearing a seat belt and not using cellular devices while the vehicle is moving.

Nice To Haves

Experience with US Combatant Commands, particularly USCENTCOM or USSOCOM.
Technical background with system administration, architecture, and engineering.
Technical background in networking, identity management, Microsoft and Linux operating systems, databases, and mobility.
Knowledge of Telos Xacta or Enterprise Mission Assurance Support Services (eMASS).
Knowledge of cyber network defense tools such as endpoint security, SIEM, and comply-to-connect.

Responsibilities

Perform Assessment and Authorization coordination and advise customers on RMF requirements.
Develop Plans of Action and Milestones to resolve network deficiencies in accordance with DoDI 8510.01 and ICD 503.
Assess network compliance against NIST 800-53 controls and create A&A packages.
Assess, validate, and report IT system and network compliance for USSOCOM, Component Commands, TSOCs, and deployed forces.
Advise on network and system risks, mitigation courses of action, and operational considerations.
Perform security evaluations and vulnerability assessments using ACAS, Nessus, and Security Content Automation Protocol tools; identify applicable STIGs.
Liaise with network and system administrators to correct identified deficiencies and coordinate with the Site Integration Facility to ensure DISA STIG compliance.
Scan or review scans for new systems and applications, identify issues, and draft certification letters for the government.
Track A&A status of SIE-governed information systems and maintain artifacts and documentation in the designated cybersecurity tool.
Provide DoD and Intelligence Community RMF subject-matter expertise and assist with development and execution of the RMF program.
Maintain, track, and validate DISN, cloud, and DIA connection approval packages.
Develop and maintain supporting documentation for new and existing networks, cloud environments, information systems, and technologies.
Develop and review A&A documentation for networks, cloud environments, systems, services, circuits, mobile and portable devices, hardware, and software to obtain ATO, IATT, or ATC.
Perform risk and vulnerability assessments and prepare risk assessment reports for submission to security control assessors and authorizing officials.
Assist with enforcement of A&A requirements and applicable connection standards.
Maintain A&A databases, websites, and tools to ensure networks, systems, and devices are documented and managed from a cybersecurity perspective.
Track and report cybersecurity compliance to higher headquarters, including USCYBERCOM and DIA, and issue timely notices to prevent accreditation lapses.
Develop and maintain an Information Security Continuous Monitoring Plan addressing information security, vulnerabilities, controls, and threats.
Identify, assess, and advise on cybersecurity control compliance and associated risks.
Coordinate with USCYBERCOM, DoD, DIA, NSA, DISA, and subordinate organizations to resolve security, A&A, connection approval, and waiver issues.
Perform security authorization and assessments and support policy execution and project management.
Validate system patching, conduct validation scans, develop POA&Ms, and report in accordance with applicable policies and regulations.
Provide subject-matter expertise for courses of action and cybersecurity mitigation strategies.
Develop and implement processes, procedures, and capabilities to mitigate software and hardware vulnerabilities and weaknesses.
Identify, implement, and validate the continued effectiveness of key performance parameters and security measures.
Analyze cybersecurity posture and report to authorizing officials and stakeholders as required.
Travel to customer and test locations, as needed, to support projects.