Cybersecurity Compliance Analyst

RCG•Suitland, MD

4d•$115,000 - $125,000•Hybrid

About The Position

RCG is seeking a Cybersecurity Compliance Analyst to support Information System Security Officers (ISSOs) in maintaining cybersecurity compliance for assigned federal FISMA systems. This role is focused on the day-to-day coordination and execution of cybersecurity compliance activities, including Continuous Monitoring, Security Control Assessments (SCAs), RMF and A&A/ATO support, POA&M tracking, vulnerability remediation, and security documentation. The successful candidate will work under the direction of the ISSO and collaborate closely with System Owners, engineers, system administrators, and other technical stakeholders to ensure cybersecurity documentation, evidence, and supporting artifacts are complete, current, accurate, and ready for Government or assessor review.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Engineering, or a related field. An equivalent combination of education and relevant experience may be considered based on applicable labor-category requirements.
Experience supporting cybersecurity compliance, federal FISMA systems, security documentation, Continuous Monitoring, Security Control Assessments, or related RMF activities.
Working knowledge of: NIST Risk Management Framework (RMF), NIST SP 800-53, FISMA, FIPS 199/200, Assessment & Authorization (A&A) / Authority to Operate (ATO), Continuous Monitoring, POA&M management, Security Control Assessment processes.
Experience developing, reviewing, maintaining, and tracking cybersecurity documentation and supporting evidence.
Experience supporting vulnerability remediation and compliance tracking.
Strong documentation, organization, quality-review, and stakeholder-coordination skills.
Ability to manage multiple compliance activities, deliverables, and deadlines while maintaining accurate records and supporting evidence.
Strong written and verbal communication skills.
Ability to work effectively with both cybersecurity and technical infrastructure teams.
U.S. Citizenship required.
Must be eligible to obtain and maintain a Secret clearance.

Nice To Haves

Experience supporting federal government cybersecurity or information assurance programs.
Experience using JSAM or similar Government cybersecurity compliance and tracking systems.
Experience supporting Security Control Assessments, audits, inspections, and authorization activities.
Experience supporting vulnerability management and POA&M remediation activities.
CompTIA Security+ or an equivalent certification meeting applicable labor-category requirements.
Additional certifications such as CGRC, CISA, CISM, CISSP, or relevant cloud-security certifications are desirable based on assignment.

Responsibilities

Provide day-to-day cybersecurity compliance and systems-analysis support to assigned ISSOs and FISMA systems.
Prepare, maintain, and update Continuous Monitoring schedules, trackers, packages, and supporting documentation.
Collect, organize, review, and track security-control evidence and supporting artifacts for recurring compliance activities.
Maintain compliance calendars, action-item logs, deliverable trackers, and status reports for ISSO review.
Identify missing, overdue, or incomplete compliance requirements and escalate risks, deficiencies, or schedule concerns to the ISSO.
Support recurring compliance meetings, cybersecurity data calls, assessment activities, and status reporting.
Prepare Security Control Assessment documentation and evidence packages.
Coordinate security-control evidence and artifact requests with system and technical stakeholders.
Maintain assessment trackers and document outstanding evidence requests.
Track SCA findings through remediation and closure.
Review cybersecurity documentation and supporting artifacts for completeness, consistency, currency, and readiness for Government or assessor review.
Support audit and assessment readiness by maintaining complete, current, and traceable documentation and evidence for internal and external reviews, assessments, inspections, and authorization activities.
Support NIST Risk Management Framework (RMF) and Assessment & Authorization (A&A)/Authority to Operate (ATO) activities.
Develop, update, and perform quality reviews of cybersecurity documentation, including: System Security Plans (SSPs), FIPS 199/200 documentation, Risk assessments, Security-control implementation statements, Authorization artifacts.
Review system Change Requests and support the preparation and tracking of Security Threshold Analysis (STA) and Security Impact Analysis (SIA) documentation.
Coordinate updates to cybersecurity documentation resulting from system or configuration changes.
Maintain accurate cybersecurity records and compliance information in JSAM and other Government-designated repositories and tracking tools.
Support the creation, maintenance, and status tracking of Plans of Action and Milestones (POA&Ms).
Track remediation activities, supporting evidence, milestones, and closure documentation.
Review vulnerability findings and track patching, configuration hardening, and remediation activities.
Coordinate with technical teams to obtain supporting evidence demonstrating remediation.
Ensure applicable POA&M records and supporting documentation remain accurate and current for ISSO review.
Coordinate with ISSOs, System Owners, engineers, system administrators, and other technical stakeholders to obtain required compliance documentation and evidence.
Track outstanding actions and follow up with responsible stakeholders to ensure compliance deadlines are met.
Communicate compliance status, outstanding requirements, and potential schedule concerns clearly and accurately.
Provide organized and timely information to support ISSO decision-making and Government reporting requirements.