Cybersecurity Risk & Exposure Analyst II

Invictus International Consulting, LLC • Colorado Springs, CO

4d • Onsite

About The Position

This role involves independently performing operational vulnerability and exposure analysis, as well as continuous monitoring activities. These activities support Security Operations Center (SOC) investigations, cyber risk prioritization, and system security coordination. The analyst will correlate various data sources, including ACAS/Tenable findings, runZero asset context, STIG/configuration information, system criticality, and network/security telemetry, to assess the relevance and potential impact of identified weaknesses. The position requires providing vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts, identifying weaknesses that could lead to exploitation or increase mission risk. Coordination with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams is essential for validating affected assets, clarifying risk, supporting mitigation, and determining continuous monitoring or RMF follow-up. The role also includes analyzing recurring vulnerabilities and exposure patterns to identify remediation priorities and systemic issues. Developing and maintaining repeatable checklists, procedures, and metrics for operational exposure analysis, remediation validation, SOC-to-ISSO coordination, and continuous-monitoring support is a key responsibility. Accurate record-keeping of findings, remediation status, risk decisions, and supporting evidence is required. The analyst will apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk in operational terms.

Requirements

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree.
• Minimum four (4) years of relevant experience in addition to education level.
• Strong written and verbal communication skills and the ability to document technical work clearly.
• Demonstrated knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF/security controls, and technical risk assessment appropriate to the position level.
• Ability to correlate vulnerability, asset, configuration, and system-security information and communicate operational risk to technical and compliance stakeholders.
• Must possess current DoD 8570 IAT II or IAM II certification.
• Experience working in a DoD or IC environment.
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph.

Nice To Haves

• Experience with ACAS/Tenable, runZero or comparable asset-discovery/exposure tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, security-control evidence, or comparable technologies and processes is desired.

Responsibilities

• Independently perform operational vulnerability/exposure analysis and continuous-monitoring activities supporting SOC investigations, cyber risk prioritization, and system security coordination.
• Correlate ACAS/Tenable findings, runZero asset context, STIG/configuration information, system criticality, network/security telemetry, and other available data to assess the relevance and potential impact of identified weaknesses.
• Provide vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts during investigations and proactive analysis; identify known weaknesses that may contribute to exploitation or increase mission risk.
• Coordinate SOC-derived findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams to validate affected assets, clarify risk, support mitigation, and determine required continuous-monitoring or RMF follow-up.
• Analyze recurring vulnerabilities, configuration weaknesses, and exposure patterns to identify remediation priorities and systemic conditions requiring escalation or broader corrective action.
• Develop and maintain repeatable checklists, procedures, and metrics for operational exposure analysis, remediation validation, SOC-to-ISSO coordination, and continuous-monitoring support.
• Maintain accurate records of findings, remediation status, risk decisions, tickets/actions, and supporting evidence in approved systems.
• Apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk in operational terms.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level