Information Assurance Analyst

Atlas Technologies•North Charleston, SC

About The Position

Atlas Tech, a veteran-owned IT company serving multiple DoD customers, is seeking an Information Assurance Analyst to join its Information Systems Security Engineering team. The role supports analysis and evaluation of the information security of Naval software systems and technical implementation of Risk Management Framework (RMF) Assessment and Authorization (A&A) services. The analyst conducts cybersecurity and risk assessments to identify and mitigate technical and non-technical vulnerabilities across systems, networks, containerized environments, and architectures. The analyst evaluates system security policies and requirements through the information system lifecycle; performs vulnerability scanning, configuration assessment, and compliance reporting; and supports remediation and authorization activities. The role also evaluates new hardware, endpoints, and collaborative technologies against applicable DISA requirements; researches task orders, vulnerabilities, and scanning data; and prepares formal cybersecurity documentation. Additional work includes mentoring and training colleagues, scanning container environments, implementing and optimizing Azure security services, automating security workflows, and working with engineering teams to diagnose defects and develop fixes.

Requirements

At least 6 years of hands-on relevant technical cybersecurity experience, or at least 2 years of experience in an Information Assurance Analyst or cybersecurity engineering role in DoD environments with a bachelor's degree in a related field.
U.S. citizenship.
Active DoD Secret clearance or higher, with enrollment in Continuous Evaluation.
DoD 8140/8570 certification qualifying at IAT Level II, such as CompTIA Security+ CE or equivalent.
Demonstrated experience executing and validating STIG and SRG test plans across complex enterprise baselines.
Advanced proficiency with ACAS/Tenable Nessus, DISA STIG Viewer, Evaluate STIG, and eMASS/eMASSter reporting tools.
Experience writing detailed technical mitigation statements and false-positive justifications for POA&Ms submitted for AO/NAO review.
Working knowledge of Microsoft Windows Server/Client platforms and RHEL systems, including hardening, patch management, and scanning methodologies.
Ability to evaluate endpoint vulnerabilities, including GPO compliance and registry configurations, to mitigate fleet-wide security risks.
Experience identifying, reconciling, and managing technical debt and defect tracking in Jira or equivalent systems.
Familiarity with SDLC methodologies, NIST Special Publications including SP 800-37, 800-53, and 800-115, and CNSSI 1253.
Strong written communication and technical authorship skills, including the ability to develop SOPs and comprehensive compliance artifact packages.
Strong collaboration and interpersonal skills, including the ability to facilitate communication among regional labs, engineering teams, product owners, and government validators.

Nice To Haves

Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related Information Technology field.
Direct experience supporting U.S. Navy afloat or shore network programs, such as CANES, NAVWAR RMF baselines, ESU, or SSA tasking.
Experience with container security tools and CI/CD pipeline integration, such as Anchore Enterprise, JFrog Xray, SBOM generation, Docker/Podman, or Spork+ repository integration.
Hands-on experience conducting containerized STIG evaluations, such as for NGINX, PostgreSQL, or container compliance.
Experience conducting cybersecurity evaluations of dedicated hardware, peripherals, and enterprise conferencing systems, such as Cisco Room Bar/VTC systems or Enterprise Video/Voice Messaging SRGs.
Practical experience working in an Agile/Scrum development environment.
RHCSA coursework or equivalent Linux administration credentials.
Hands-on experience with Azure architectures, including AKS containerized workloads, identity and access management, and cloud-native security tooling.
Programming or scripting skills in Python, PowerShell, or similar languages for automating scans, developing tools, and contributing to engineering solutions.
Experience debugging software issues in complex systems and producing functional code updates, patches, or prototypes.

Responsibilities

Analyze, design, implement, test, and field secure systems, networks, containerized environments, and architectures in accordance with RMF and NIST guidelines.
Evaluate information systems security policies and ensure system security requirements and DISA mandates are addressed throughout acquisition and the information system lifecycle.
Conduct vulnerability scans, assess asset and policy configurations, and prepare compliance reports using ACAS and Evaluate STIG.
Collaborate with systems and software engineers to remediate vulnerabilities, analyze root causes, and write technical mitigations for POA&M findings.
Support ATO packages and Annual Security Review events by evaluating STIG checks and SRGs across multi-enclave baselines, validating findings, and identifying lab-specific false positives.
Evaluate hardware, endpoint baselines, and collaborative technologies against applicable DISA SRGs and STIGs.
Research high-visibility task orders, newly disclosed CVEs, and Nessus plugins to support fleet patch management, operational tasking, and early ECR development.
Author and standardize technical documentation, including SOPs, eMASSter reports, Cybersecurity Strategies, SSPs, and checklist guidance.
Mentor colleagues and conduct hands-on training, including RHEL scan preparation and STIG evaluation workflows.
Perform regular security scans of containerized environments to identify vulnerabilities, configuration drift, and compliance gaps.
Implement, monitor, and optimize Microsoft Azure security services, including Azure Security Center, Defender for Cloud, Key Vault, and Azure Policy.
Build automated workflows and scanning pipelines to improve security visibility and reduce manual effort across container and cloud assets.
Work with engineering teams to diagnose software defects found during assessments and support development of technical fixes.