FISMA Security Analyst

Systems Engineering Solutions Corporation

About The Position

SES is seeking a subject matter expert FISMA Security Analyst to support federal compliance and governance requirements for systems supported by the Task Order. The role assists the XGen DIGIT Director of Enterprise Security in managing and executing GSA IT Enterprise Security Management and IT Continuity Management Services. The team works with technology partners to apply emerging technologies and best practices in support of GSA’s IT capabilities and digital services. The analyst provides technical and governance support across enterprise security architecture, system security, risk management, compliance, and continuous monitoring. The work includes applying NIST SP 800-53 Revision 5 and the NIST Risk Management Framework, preparing and maintaining FISMA and RMF documentation, and assessing risks arising from APIs, integrations, robotic process automation, and emerging technologies. The role may involve leading or supervising others and requires independent work, including in a full or partial remote environment. The position follows standard working hours under the DIGIT contract and requires availability for meetings and collaboration during those hours. Travel is not required. If remote, the employee must maintain a safe home workspace consistent with information security policies.

Requirements

Ability to obtain a Public Trust Clearance and ITILv4 Foundation Certification.
Comprehensive knowledge across key tasks and high-impact assignments, with the ability to apply practical experience and training to determine how to accomplish work.
Ability to function as a security expert across multiple project assignments.
Ability to work independently in a full or partial remote environment with limited supervision; may supervise or lead others.
Effective oral and written communication with staff at all levels and with clients.
10–15 years of experience and a bachelor's degree or equivalent.
At least 3–5 years of direct experience supporting FISMA and financial audit requirements.
At least 3–5 years of direct experience supporting cybersecurity compliance and implementing threat-mitigation steps.
At least 3–5 years of direct experience providing continuous-monitoring security expertise to business units and key stakeholders.
At least 3–5 years of direct experience creating and delivering end-user briefings, training, policy, and/or compliance updates.
Experience as a remote worker demonstrating time management, self-discipline, cultural change management, and an Agile mindset.

Nice To Haves

CISSP, CISA, CISM, Security+, or other relevant security certifications.
Familiarity with CUI requirements for unclassified IT systems.
A track record of competency in obtaining initial A&A and reauthorization.
Familiarity with unclassified network administration, including network infrastructure and security best practices.
Experience with LAN administration and maintenance, including user control and VPN access.
Familiarity with firewalls, mobile device management, and identity and authentication services management.
Comfort with Windows operating systems.
Linux operating systems experience.
Familiarity with Google Suite, Microsoft Office, and ServiceNow.
Willingness and ability to independently take on a variety of IT compliance tasks.

Responsibilities

Provide technical support to divisions and branches developing security architecture and supporting the design and implementation of IT security systems.
Research security products and services and support rollout of enterprise security solutions using Department-wide license agreements with vendors and service providers.
Lead the development, implementation, and maintenance of enterprise-wide information security capabilities.
Analyze enterprise business models and IT systems to identify security risks and risk management considerations.
Define enterprise- and system-level security requirements.
Support implementation and assessment of security and privacy controls in accordance with NIST SP 800-53 Revision 5 and applicable federal control baselines.
Support the NIST Risk Management Framework lifecycle, including control implementation, assessment, authorization, and continuous monitoring.
Assist with developing, reviewing, and maintaining RMF and FISMA documentation, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, risk assessments, control implementation statements, procedures, governance documentation, and authorization packages.
Propose technical solutions for system- and application-level security architecture and design to reduce risk and support compliance objectives.
Support continuous monitoring, including vulnerability management, control assessments, risk tracking, remediation validation, and stakeholder reporting.
Assess cybersecurity risks associated with APIs, integrations, data exchanges, and automated workflows, including authentication, authorization, encryption, logging, monitoring, and data protection.
Review API design and implementation for compliance with security requirements, secure configuration, access controls, token management, and sensitive-data protection.
Assess RPA bots and workflows, including service accounts, credential management, privilege assignments, logging, exception handling, and operational resilience.
Identify and document risks related to intelligent automation, RPA, API integrations, and emerging technologies, and recommend mitigation strategies aligned with enterprise risk tolerance.
Maintain standard working hours under the DIGIT contract and be available for meetings and collaborative efforts.
When working remotely, maintain a safe home workspace and protect company and customer information.