Cybersecurity Risk Management Analyst
About The Position
The Cybersecurity Risk Management Analyst provides advanced Governance, Risk, and Compliance (GRC) support for federal information systems in accordance with the Federal Information Security Modernization Act (FISMA) and the NIST Risk Management Framework (RMF). This role is responsible for managing Assessment & Authorization (A&A) activities, supporting external service authorizations, conducting cybersecurity risk assessments, and maintaining continuous monitoring efforts to ensure compliance with federal cybersecurity requirements. The position requires strong analytical, documentation, and stakeholder engagement skills while working collaboratively with federal system owners, Information System Security Officers (ISSOs), Cloud Service Providers, and executive leadership to maintain secure and compliant federal systems.
Requirements
- Bachelor's degree in Cybersecurity, Information Technology, Public Policy, or related discipline (or equivalent experience).
- Professional cybersecurity certification such as: CISSP, CISM, CAP
- Minimum seven (7) years of progressive cybersecurity experience.
- Minimum four (4) years supporting federal Risk Management Framework (RMF) and Assessment & Authorization (A&A) programs.
- Demonstrated experience implementing the NIST Risk Management Framework.
- Strong working knowledge of: Federal Risk and Authorization Management Program (FedRAMP), NIST Special Publication 800-53 Revision 5, Federal Information Security Modernization Act (FISMA), Federal Zero Trust Strategy (OMB M-22-09).
- Experience supporting Moderate and/or High Impact federal information systems.
- Familiarity with federal cloud security requirements and FedRAMP-authorized cloud environments.
- Proficiency with Microsoft Office 365 applications.
- Excellent written and verbal communication skills.
- Ability to communicate effectively with technical teams and executive leadership.
- Active Public Trust clearance or the ability to obtain and maintain one.
Nice To Haves
- Experience using ServiceNow, CSAM, or comparable GRC platforms.
- Experience with Atlassian Confluence and JIRA.
- Experience supporting enterprise cybersecurity policy development.
- Familiarity with Responsible AI guidance applicable to federal agencies, including Executive Order 13960, OMB M-25-21, and OMB M-25-22.
- Experience supporting federal research or grant-management systems.
Responsibilities
- Manage the full lifecycle of Risk Management Framework (RMF) activities in accordance with NIST Special Publication 800-37.
- Develop, review, and maintain security authorization documentation including: System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms).
- Review and evaluate FedRAMP authorization packages and package updates supporting cloud service authorization decisions.
- Monitor Authorization to Operate (ATO) packages within the FedRAMP Secure Repository.
- Coordinate with system owners, ISSOs, Cloud Service Providers, and security stakeholders regarding system changes and authorization activities.
- Validate implementation of NIST SP 800-53 Rev. 5 security controls, including inherited and agency-implemented controls.
- Conduct cybersecurity risk assessments utilizing NIST SP 800-30 methodologies.
- Provide risk analysis and recommendations to Authorizing Officials and senior leadership.
- Support continuous monitoring by reviewing vulnerability scans, managing POA&Ms, and coordinating remediation activities.
- Peer review cybersecurity policies, standards, procedures, and implementation guidance.
- Perform regulatory and policy analysis to ensure alignment with federal cybersecurity requirements.
- Conduct compliance gap analyses and recommend remediation strategies.
- Assist in developing security control overlays, baseline updates, and control tailoring guidance.
- Provide cybersecurity governance subject matter expertise.
- Support enterprise reporting, cybersecurity metrics, and compliance dashboards utilizing ServiceNow.
- Support FISMA reporting activities.
- Prepare documentation for internal and external audits and oversight reviews.
- Assist with responses to oversight inquiries and corrective action tracking.
- Perform quality assurance reviews of cybersecurity documentation.
- Perform other job-related duties as assigned.
Benefits
- Medical
- Dental
- Vision
- 401(k)
- paid time off
- other company-sponsored benefits
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
