Cyber Security Systems Analyst (Intermediate)

Amentum•Tampa, FL

1d•$78,000 - $83,000•Onsite

About The Position

Amentum is seeking a Cybersecurity Systems Analyst to provide full-time, onsite Assessment and Authorization (A&A) support under the Risk Management Framework (RMF) for USSOCOM, its Component Commands, TSOCs, and deployed forces. The role supports defense in depth across networks, systems, services, and devices, assessing risks and helping ensure confidentiality, integrity, and availability in accordance with national, DoD, DIA, NSA, and Intelligence Community requirements. The analyst follows DoD RMF and ICD 503 and supports connection approval packages for DISN and DIA authorities, as well as Commercial Solutions for Classified registration with NSA. The analyst evaluates network and system compliance, develops A&A packages and remediation plans, performs risk and vulnerability assessments, and advises stakeholders on risks and mitigation options. The position involves assessing systems and applications being introduced into the SOF environment, coordinating remediation with administrators and the Site Integration Facility, and maintaining authorization documentation and status in cybersecurity tools. The analyst also provides RMF subject matter expertise, supports continuous monitoring, develops security processes and mitigation capabilities, and reports cybersecurity posture to authorizing officials and other stakeholders. This position is located onsite in Tampa, Florida. Normal hours are Monday through Friday between 6:00 a.m. and 4:00 p.m. Travel of up to 10% may be required. An active TS/SCI clearance is required. The role may require lifting up to 40 pounds and working in an indoor office environment such as a cubicle.

Requirements

At least 5 years of experience.
Bachelor’s degree (BA/BS).
Current DoD 8570.01-M IAT Level III or IAM Level III certification; listed examples include CISSP or Associate, CASP+ CE, SecurityX CE, CISA, CISM, CCISO, GCED, GCIH, CCSP, or GSLC.
Active TS/SCI clearance.
Working knowledge of the Risk Management Framework (RMF).
Knowledge and experience with DoD information assurance processes and policies, including DoDI 8510.01, NIST, CNSS, CJCSM 65101.01, incident response, and other IA policies.
Excellent written and oral communication and interpersonal skills.
Ability to lift up to 40 pounds as necessary.
Ability to work effectively with coworkers and all levels of management in an indoor office environment.
Ability to operate office equipment, including a personal computer, printer, copier, telephone, and fax machine.
Independent personal transportation to the office or work site is required.
Ability to travel up to 10% to customer and test locations, potentially by airline.
Must communicate clearly, concisely, and accurately in English and demonstrate professional behavior.
Must comply with vehicle safety requirements when driving for work, including seat-belt use and no cellular-device use while the vehicle is moving.

Nice To Haves

Experience with US Combatant Commands, particularly USCENTCOM or USSOCOM.
Technical background in system administration, architecture, and engineering.
Technical background in networking, identity management, Microsoft and Linux operating systems, databases, and mobility.
Knowledge of Telos Xacta or Enterprise Mission Assurance Support Services (eMASS).
Knowledge of cyber network defense tools such as endpoint security, SIEM, and comply-to-connect.

Responsibilities

Coordinate assessment and authorization activities, advise customers on RMF, and develop Plans of Action and Milestones to address network deficiencies.
Assess network compliance against NIST 800-53 controls and create A&A packages.
Assess, validate, and report compliance of customer networks, systems, services, devices, and applications with applicable regulations and security standards.
Identify potential system shortcomings and vulnerabilities, advise stakeholders on risks and mitigation courses of action, and support implementation of cybersecurity mitigation strategies.
Perform security evaluations and vulnerability assessments using ACAS, Nessus, and Security Content Automation Protocol tools; identify applicable STIGs and conduct STIG assessments.
Liaise with network and system administrators to correct identified deficiencies and coordinate with the Site Integration Facility to verify systems and applications meet DISA STIG standards.
Scan or review scans for new systems and applications entering the SOF environment, identify issues, and draft certification letters for the government.
Track A&A status of SIE-governed information systems and ensure artifacts and documentation are available in the designated cybersecurity tool.
Provide DoD and Intelligence Community RMF subject matter expertise and assist with developing and executing RMF programs.
Maintain, track, and validate DISN, cloud, and DIA connection approval packages.
Develop and maintain supporting documentation for new and existing networks, cloud environments, information systems, and technologies introduced into the SIE.
Develop and review A&A documentation for networks, cloud environments, systems, services, telecommunications circuits, mobile devices, portable electronic devices, hardware, and software to support ATO, IATT, or ATC decisions.
Perform authorization risk and vulnerability assessments and prepare risk assessment reports for the SCA and AO/DAO/DAA in accordance with applicable policies and regulations.
Assist with enforcement of A&A requirements and connection standards for networks and systems.
Track and maintain A&A databases, websites, and tools to ensure networks, systems, and devices are documented and managed from a cybersecurity perspective.
Track and report compliance with cybersecurity regulations and directives to higher headquarters organizations, including USCYBERCOM and DIA.
Provide timely accreditation-expiration notifications, including 30-, 60-, and 90-day notices.
Develop and maintain an Information Security Continuous Monitoring (ISCM) Plan addressing security awareness, vulnerabilities, controls, and threats.
Identify and assess cybersecurity control compliance and associated risks.
Coordinate with USCYBERCOM, DoD, DIA, NSA, DISA, and subordinate organizations to resolve security, A&A, connection approval, and waiver issues.
Perform security authorization and assessments for networks, cloud environments, information systems, hardware, software, and devices, and support cybersecurity policy execution and project management.
Validate system patching, conduct validation scanning, develop POA&Ms, and report as directed by applicable policy and procedures.
Develop and implement processes, procedures, and capabilities to mitigate software and hardware vulnerabilities and weaknesses; identify, implement, and validate the ongoing effectiveness of security measures.
Analyze cybersecurity posture and provide reports to the AO/DAO and stakeholders as required by ISCM and AO/DAO direction.
Travel to customer and test locations as needed, potentially by air, and maintain professional conduct and clear communications with customers, management, and coworkers.