Information Assurance Analyst II

Nakupuna Companies•Fort Belvoir, VA

About The Position

Nakupuna Companies is seeking an Information Assurance Analyst II to support the C5ISR Center cybersecurity program. The role assesses information system security posture, maintains compliance and authorization documentation, analyzes vulnerabilities and security risks, and supports RMF, FISMA, and applicable C5ISR Center assessment processes, including CORA. The analyst works with system owners, administrators, the CISO, and the Organizational Information System Security Manager (O-ISSM) to track findings, evaluate controls, maintain audit readiness, and support secure operations across applicable enterprise, application, and laboratory environments. The position supports cybersecurity priorities established by the CISO and O-ISSM and provides analysis, status reporting, actionable recommendations, and information assurance guidance to system owners, administrators, application teams, and other stakeholders. The role is located in Fort Belvoir, Virginia, and requires a Secret clearance. A bachelor's degree and five or more years of relevant experience are preferred. CompTIA Security+ CE, or another certification meeting applicable contract and DoD cyber workforce qualification requirements, is required. The projected annualized compensation range is $165,000 to $185,000.

Requirements

CompTIA Security+ CE or another certification meeting applicable contract and DoD cyber workforce qualification requirements.
Secret clearance.
Ability to perform repetitive motions with the hands, wrists, and fingers.
Ability to engage in and follow audible communications in emergencies.
Ability to sit for prolonged periods at a desk and work on a computer.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Technology, or a related field.
Five or more years of experience in information security, cybersecurity compliance, information assurance, or related system security functions.
One or more of the following certifications: CISSP, Certified in Governance, Risk and Compliance (CGRC; formerly CAP), CISM, or GIAC Security Essentials (GSEC).
Experience supporting DoD RMF authorization, eMASS, ACAS, STIG compliance, and POA&M management.

Responsibilities

Assess and monitor information system security controls, security posture, and compliance with applicable DoD, Army, NIST, and C5ISR Center requirements.
Conduct security risk analyses, review system changes for security impact, and document recommended risk mitigation actions.
Analyze vulnerability assessment results, including ACAS findings and applicable endpoint security reports; coordinate remediation with system owners and administrators and validate closure evidence.
Review security logs, alerts, inspection results, and relevant security events; document and escalate potential incidents in accordance with established procedures.
Support assessment of security control implementation and effectiveness; identify gaps, exceptions, and residual risks.
Develop, review, and maintain RMF and authorization artifacts, including security control documentation, system security plans, supporting evidence, and records in eMASS.
Support Authority to Operate (ATO) activities, periodic reviews, and ongoing authorization requirements in coordination with system owners and cybersecurity leadership.
Maintain and track POA&Ms, vulnerability findings, mitigation actions, and documented exceptions through resolution.
Support FISMA reporting, security audits, inspections, and audit readiness by collecting evidence and ensuring documentation is accurate, current, and complete.
Maintain security policies, procedures, system inventories, user lists, data flow diagrams, and other required security documentation.
Review system configurations against applicable DISA STIGs and Security Requirements Guides (SRGs), and coordinate remediation or documentation of deviations.
Provide analysis, status reporting, and actionable recommendations in support of cybersecurity priorities established by the CISO and O-ISSM.
Interpret applicable cybersecurity policies and provide information assurance guidance to system owners, administrators, application teams, and other stakeholders.
Coordinate with technical teams to assess the cybersecurity implications of proposed system, application, network, and architecture changes.
Support security awareness activities, incident response coordination, and follow-up documentation as assigned.
Process and track customer requests and cybersecurity actions through the CIO Portal or other approved service management systems.
Prepare vulnerability, compliance, risk, and authorization status reports for leadership and customer stakeholders.
Perform repetitive motions with the hands, wrists, and fingers; engage in and follow audible communications in emergencies; sit for prolonged periods at a desk and work on a computer.