Cybersecurity Policy Analyst

Quantum Sky•Washington, DC

1d•$120,000 - $130,000

About The Position

Quantum Sky is searching for a Cybersecurity Policy Analyst supports federal government cybersecurity programs by developing, analyzing, implementing, and maintaining cybersecurity policies, standards, procedures, and guidance. The position provides policy and compliance expertise to help ensure that information systems, programs, and organizational practices align with applicable federal cybersecurity requirements, risk management principles, and agency objectives. The Cybersecurity Policy Analyst works closely with cybersecurity, information technology, privacy, risk management, compliance, program management, and executive stakeholders to translate federal cybersecurity requirements into practical policies and operational procedures.

Requirements

Bachelor's degree in cybersecurity, information technology, computer science, information assurance, public policy, or a related field; equivalent professional experience may be considered.
4–7 years of experience in cybersecurity, information security, IT governance, risk management, compliance, or cybersecurity policy.
Experience interpreting and applying cybersecurity policies, standards, frameworks, and regulatory requirements.
Experience developing professional or federal policy, governance, compliance, and technical documentation.
Strong analytical, research, writing, and communication skills.
Ability to communicate complex cybersecurity requirements to technical and non-technical audiences.
Experience working with federal government agencies or federal contractors is strongly preferred.
Ability to manage multiple priorities and work effectively with government and contractor stakeholders.
Ability to obtain and maintain a U.S. government security clearance, if required by the contract.

Nice To Haves

Experience working with the NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), NIST SP 800-series publications, FISMA, FedRAMP, or related federal cybersecurity requirements.
Familiarity with OMB cybersecurity policies and federal information security directives.
Experience supporting cybersecurity governance, risk, and compliance (GRC) programs.
Experience with security controls, control assessments, POA&Ms, system security plans (SSPs), and authorization documentation.
Familiarity with privacy and cybersecurity requirements applicable to federal information systems.
Relevant certifications such as CISSP, CISM, CRISC, CISA, Security+, CAP, or equivalent credentials.
Experience supporting audits, inspections, security assessments, or regulatory reviews.
Experience preparing executive-level cybersecurity briefings and policy recommendations.

Responsibilities

Develop, review, update, and maintain cybersecurity policies, standards, procedures, guidelines, and related governance documentation.
Analyze federal cybersecurity laws, regulations, executive directives, standards, frameworks, and guidance to determine organizational applicability and implementation requirements.
Support implementation and ongoing alignment with applicable federal cybersecurity requirements, including NIST publications, FISMA, OMB guidance, and agency-specific policies and directives.
Conduct policy and compliance gap assessments and document findings, risks, recommendations, and remediation activities.
Translate technical cybersecurity requirements into clear, actionable policy and procedural guidance for technical and non-technical stakeholders.
Support the development and maintenance of cybersecurity governance frameworks, control implementation guidance, and policy repositories.
Coordinate with system owners, security personnel, privacy officials, risk executives, and other stakeholders to resolve policy and compliance issues.
Support security assessment and authorization activities by providing policy and compliance analysis and ensuring required documentation is complete and current.
Prepare executive-level briefings, status reports, dashboards, and recommendations related to cybersecurity policy and compliance.
Participate in working groups, stakeholder meetings, audits, assessments, and governance forums.
Maintain awareness of evolving federal cybersecurity priorities and recommend updates to policies and procedures as appropriate.