SCI)

RedSky•Tampa, FL

About The Position

RedSky is seeking a Cybersecurity Analyst/Information Assurance to support the Department of Defense mission through knowledge management, information sharing, collaboration, data, business processes, and digital capabilities. The position supports the Enterprise Knowledge Management (EKM) program and bridges the technical team responsible for building and operating EKM with the government's security authorization framework. The analyst ensures that systems, applications, platforms, and data assets operate within approved security boundaries and maintain continuous compliance with DoD cybersecurity mandates. The role is based in Tampa, Florida, with multiple domestic and international locations listed.

Requirements

Active Secret or TS clearance.
At least five years supporting RMF per NIST SP 800-37 and DoDI 8510.01 in a DoD environment.
At least three years supporting the full ATO lifecycle: categorization, security control selection, implementation, assessment, authorization, and continuous monitoring.
At least three years applying DISA STIGs across M365 (Exchange Online, SharePoint Online, Teams, and OneDrive), Windows Server, SQL Server, Azure, Active Directory / Entra ID, IIS, .NET, and custom web applications.
At least three years identifying STIG findings and remediating them or documenting mitigations.
At least three years preparing for and supporting CCRI findings and remediation, including vulnerability management, configuration management, IAVM compliance, account management, and physical security.
At least three years running CCRI dry runs and conducting internal compliance reviews, including audits of vulnerability scan results, STIG compliance, account reviews, privileged access, IAVM patch status, and documentation completeness.
At least three years tracking, reporting, and managing CCRI remediation-plan progress.
At least three years tracking and enforcing IAVM directives and achieving and maintaining 100% IAVM compliance for IAVAs, IAVBs, and IAVMs.
At least three years of experience with Microsoft Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps, and Microsoft Sentinel in GCC High / IL5-IL6, including security baseline configuration and attack simulation.
At least two years writing comprehensive SSPs for enterprise-scale systems-of-systems, including DoD-formatted SSPs with complete control implementation narratives.
At least two years producing monthly security status reports, CCRI readiness dashboards, IAVM compliance reports, POA&M aging reports, and executive risk summaries.
CompTIA Security+ certification.
CySA+ certification.
GICSP certification.
GSEC certification.
SSCP certification.

Responsibilities

Support the Department of Defense mission and the Enterprise Knowledge Management program.
Ensure EKM systems, applications, platforms, and data assets operate within approved security boundaries and maintain continuous compliance with DoD cybersecurity mandates.
Support the Risk Management Framework and the full Authorization to Operate lifecycle.
Apply DISA Security Technical Implementation Guides across the EKM technology stack; identify findings and remediate them or document mitigations.
Prepare for Command Cyber Readiness Inspections and support remediation of inspection findings.
Conduct CCRI dry runs and internal compliance reviews, including reviews of vulnerability scans, STIG compliance, accounts, privileged access, IAVM patch status, and documentation completeness.
Track, report, and manage progress on CCRI remediation plans.
Track and enforce IAVM directives and maintain 100% IAVM compliance.
Configure and use Microsoft security products in GCC High / IL5-IL6, including security baselines and attack simulation.
Write system security plans for enterprise-scale systems-of-systems, including complete control implementation narratives.
Produce monthly security status reports, CCRI readiness dashboards, IAVM compliance reports, POA&M aging reports, and executive risk summaries.