Cybersecurity Analyst

Odyssey Systems Consulting Group, Ltd.•Colorado Springs, CO

1d•Hybrid

About The Position

At Odyssey, Cybersecurity Analysts protect systems, data, and people from evolving cyber threats across cloud and on-premises environments. The role monitors and triages alerts from SIEM, EDR, and intrusion detection tools, investigates confirmed threats, and contains incidents by isolating hosts, blocking malicious activity, and escalating as needed. Analysts document findings, refine detection rules, and partner with IT, engineering, and compliance teams to identify vulnerabilities and drive remediation. The position also supports Odyssey’s GRC program by maintaining System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms), providing audit and assessment evidence, and supporting continuous monitoring aligned with NIST RMF and FedRAMP requirements. It supports NIST SP 800-171, NIST SP 800-53, and CMMC Level 2 requirements, including control narratives, SSPs, POA&Ms, and assessment evidence. The role is located in Colorado Springs, Colorado, with a remote or hybrid arrangement and periodic on-location work as needed. Travel is 5–10%.

Requirements

Must be a U.S. citizen.
Must be eligible to obtain and maintain a Secret clearance.
Bachelor’s degree in information security, information systems, or a related field, or equivalent experience.
3 to 5 years of experience in security compliance, audit, or GRC, including hands-on experience with NIST SP 800-171 or NIST SP 800-53.
CompTIA Security Plus certification or equivalent.
Knowledge of Microsoft 365 and Azure compliance tooling, including Purview, Compliance Manager, Defender for Cloud, and Intune.
Experience with SIEM, EDR, and vulnerability scanning tools to support continuous monitoring.
Knowledge of security awareness and phishing simulation platforms.
Knowledge of NIST SP 800-171, NIST SP 800-171A, NIST SP 800-53, and CMMC Level 2 requirements.
Experience with CUI and FCI scoping, asset categorization, and assessment boundary definition.
Ability to write control narratives, SSPs, POA&Ms, and assessment evidence packages.
Ability to coordinate compliance evidence and communicate status and risk to technical and nontechnical stakeholders.

Nice To Haves

Active Secret clearance.
5 to 8 years of experience supporting a DoD contractor or SOC organization, including CUI environments such as Microsoft GCC High.
Prior participation in a C3PAO assessment.
SecurityX Plus, CISA, CRISC, or CISSP certification.

Responsibilities

Monitor alerts from SIEM, EDR, and intrusion detection systems, triage them to identify genuine threats or false positives, and determine urgency.
Investigate logs, network traffic, and endpoint activity to determine what happened and the extent of a threat.
Contain threats by isolating hosts, blocking IP addresses or accounts, and escalating serious incidents.
Document findings and actions in tickets and incident reports.
Refine detection rules to reduce noise and identify emerging attack techniques.
Support NIST SP 800-171, NIST SP 800-53, and CMMC Level 2 requirements by writing control narratives, SSPs, POA&Ms, and assessment evidence.
Support the GRC program by maintaining SSPs and POA&Ms, providing audit and assessment evidence, and supporting continuous monitoring aligned with NIST RMF and FedRAMP requirements.
Serve as the primary contact for assessors, prime contractors, and customers.
Coordinate evidence across HR, facilities, export compliance, and IT.
Prepare clear, defensible packages for executive signature.
Hold control owners accountable for resolving findings through closure.
Communicate compliance status and risk to technical and nontechnical stakeholders.
Partner with IT, engineering, and compliance teams to identify vulnerabilities and drive remediation.