Cybersecurity Risk & Exposure Analyst II

Invictus International Consulting, LLC • Alexandria, VA

4d • Onsite

About The Position

Independently perform operational vulnerability/exposure analysis and continuous-monitoring activities supporting SOC investigations, cyber risk prioritization, and system security coordination. Correlate ACAS/Tenable findings, runZero asset context, STIG/configuration information, system criticality, network/security telemetry, and other available data to assess the relevance and potential impact of identified weaknesses. Provide vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts during investigations and proactive analysis; identify known weaknesses that may contribute to exploitation or increase mission risk. Coordinate SOC-derived findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams to validate affected assets, clarify risk, support mitigation, and determine required continuous-monitoring or RMF follow-up. Analyze recurring vulnerabilities, configuration weaknesses, and exposure patterns to identify remediation priorities and systemic conditions requiring escalation or broader corrective action. Develop and maintain repeatable checklists, procedures, and metrics for operational exposure analysis, remediation validation, SOC-to-ISSO coordination, and continuous-monitoring support. Maintain accurate records of findings, remediation status, risk decisions, tickets/actions, and supporting evidence in approved systems. Apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk in operational terms.

Requirements

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position, or an additional 4 years of experience in lieu of a degree.
• Minimum four (4) years of relevant experience in addition to education level.
• Strong written and verbal communication skills and the ability to document technical work clearly.
• Demonstrated knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF/security controls, and technical risk assessment appropriate to the position level.
• Must possess current DoD 8570 IAT II or IAM II certification.
• Experience working in a DoD or IC environment.
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph.

Nice To Haves

• Experience with ACAS/Tenable, runZero or comparable asset-discovery/exposure tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, security-control evidence, or comparable technologies and processes.

Responsibilities

• Perform operational vulnerability/exposure analysis and continuous-monitoring activities.
• Correlate various data sources to assess the relevance and potential impact of identified weaknesses.
• Provide vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts.
• Coordinate SOC-derived findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams.
• Analyze recurring vulnerabilities, configuration weaknesses, and exposure patterns to identify remediation priorities.
• Develop and maintain repeatable checklists, procedures, and metrics.
• Maintain accurate records of findings, remediation status, risk decisions, tickets/actions, and supporting evidence.
• Apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level