Information Assurance Analyst II

Na Ali'i Consulting & Sales, LLC.•Fort Belvoir, VA

10h•$165,000 - $185,000•Onsite

About The Position

Nakupuna Companies is seeking an Information Assurance Analyst II to support the C5ISR Center cybersecurity program. The role assesses information system security posture, maintains compliance and authorization documentation, analyzes vulnerabilities and security risks, and supports the Risk Management Framework (RMF), FISMA, and C5ISR Center assessment processes, including CORA. The analyst works with system owners, administrators, the CISO, and the Organizational Information System Security Manager (O-ISSM) to track findings, evaluate controls, maintain audit readiness, and support secure operations across applicable enterprise, application, and laboratory environments. The position supports security assessments and risk management, RMF authorization and documentation, compliance reporting, and operational cybersecurity support. Responsibilities include analyzing vulnerability results, coordinating remediation, maintaining eMASS artifacts and POA&Ms, reviewing configurations against DISA STIGs and SRGs, and preparing status reports for leadership and customer stakeholders. The position is located in Fort Belvoir, Virginia. A Secret clearance is required. The projected annualized compensation range is $165,000 to $185,000.

Requirements

CompTIA Security+ CE or another certification meeting applicable contract and DoD cyber workforce qualification requirements.
Secret clearance.
Ability to perform repetitive motions with the hands, wrists, and fingers.
Ability to engage in and follow audible communications in emergencies.
Ability to sit for prolonged periods at a desk and work on a computer.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Technology, or a related field.
Five or more years of experience in information security, cybersecurity compliance, information assurance, or related system security functions.
CISSP certification.
Certified in Governance, Risk and Compliance (CGRC; formerly CAP) certification.
CISM certification.
GIAC Security Essentials (GSEC) certification.
Experience supporting DoD RMF authorization, eMASS, ACAS, STIG compliance, and POA&M management.

Responsibilities

Assess and monitor information system security controls, security posture, and compliance with applicable DoD, Army, NIST, and C5ISR Center requirements.
Conduct security risk analyses, review system changes for security impact, and document recommended risk mitigation actions.
Analyze vulnerability assessment results, including ACAS findings and applicable endpoint security reports; coordinate remediation with system owners and administrators and validate closure evidence.
Review security logs, alerts, inspection results, and relevant security events; document and escalate potential incidents in accordance with established procedures.
Support assessment of security control implementation and effectiveness; identify gaps, exceptions, and residual risks.
Develop, review, and maintain RMF and authorization artifacts, including security control documentation, system security plans, supporting evidence, and records in eMASS.
Support Authority to Operate (ATO) activities, periodic reviews, and ongoing authorization requirements in coordination with system owners and cybersecurity leadership.
Maintain and track Plans of Action and Milestones (POA&Ms), vulnerability findings, mitigation actions, and documented exceptions through resolution.
Support FISMA reporting, security audits, inspections, and audit readiness by collecting evidence and ensuring documentation is accurate, current, and complete.
Maintain security policies, procedures, system inventories, user lists, data flow diagrams, and other required security documentation.
Review system configurations against applicable DISA STIGs and Security Requirements Guides (SRGs), and coordinate remediation or documentation of deviations.
Support cybersecurity priorities established by the CISO and O-ISSM, providing analysis, status reporting, and actionable recommendations.
Interpret applicable cybersecurity policies and provide information assurance guidance to system owners, administrators, application teams, and other stakeholders.
Coordinate with technical teams to assess the cybersecurity implications of proposed system, application, network, and architecture changes.
Support security awareness activities, incident response coordination, and follow-up documentation as assigned.
Process and track customer requests and cybersecurity actions through the CIO Portal or other approved service management systems.
Prepare vulnerability, compliance, risk, and authorization status reports for leadership and customer stakeholders.
Perform repetitive motions with the hands, wrists, and fingers; engage in and follow audible communications in emergencies; and sit for prolonged periods at a desk while working on a computer.