Information Assurance Support Analyst

Astrion • Rockville, MD

9d • Onsite

About The Position

Astrion is seeking an Information Assurance Support Analyst to support the NRC-CPSS Contract within the Civilian Division. The role supports FISMA systems through Security Assessment and Authorization (SA&A), the NIST Risk Management Framework (RMF), and continuous monitoring. The analyst works with system administrators, Information System Security Officers (ISSOs), Authorizing Officials (AOs), and other stakeholders to assess and manage security risks, maintain authorization documentation, perform vulnerability and configuration compliance reviews, and support FedRAMP requirements for cloud services. The position is based in Rockville, Maryland, requires an NRC Clearance, and involves occasional domestic travel (10%).

Requirements

• Bachelor of Arts or Bachelor of Science degree, or five additional years of equivalent experience.
• Six years of IT experience, including four years specializing in Information Assurance.
• Secret Clearance and the ability to obtain an NRC Security Clearance.
• U.S. citizenship.
• Hold at least one of the following certifications: CompTIA Security+, CISSP, ISACA CISA, GIAC GSEC, GIAC GSNA, GIAC GPEN, CEH, CAP, CASP+, CRISC, or CCSK.

Nice To Haves

• Strong understanding of FISMA and NIST Special Publications, especially NIST SP 800-37 and NIST SP 800-53.
• Excellent written and oral communication skills and attention to detail.
• Experience with vulnerability scanning tools such as Tenable Security Center.
• Working knowledge of DISA STIGs, SCAP content and audit files, and CIS Benchmarks.
• Understanding of SaaS, PaaS, and IaaS cloud service models and protections described in FedRAMP security documentation.
• Experience reviewing FedRAMP authorization packages and ensuring customer responsibilities are addressed under the shared responsibility model.
• Experience performing technical architecture reviews of complex systems and strong understanding of system authorization.
• Knowledge of major cloud platforms such as Azure and AWS; virtualization; networking devices such as routers and switches; web services such as IIS and Apache Tomcat; network security appliances such as firewalls and VPNs; databases such as Microsoft SQL; and intrusion prevention and anti-malware software.
• Knowledge of system and application security threats and vulnerabilities.
• Proficiency with Microsoft Office applications.
• Ability to prioritize and complete tasks efficiently and effectively.
• Comfort working individually and as part of a team.
• Scripting ability, such as PowerShell or VBA, is a plus.
• Familiarity with AI tools such as chat technologies to enhance personal productivity.

Responsibilities

• Work with personnel at all levels, including system administrators, ISSOs, and the AO, to support FISMA systems through Security Assessment and Authorization (SA&A).
• Assess the confidentiality, integrity, and availability impact levels of information stored, possessed, and transmitted by systems to determine FIPS 199 security categorizations.
• Develop and maintain system security documentation throughout all phases of the NIST Risk Management Framework, including security categorizations, digital identity risk assessments, system security plans, system policies and procedures, privacy impact assessments, contingency plans, configuration management plans, incident response plans, vulnerability assessment reports, and deviation requests.
• Analyze risks identified during security control assessments and continuous monitoring in accordance with NIST SP 800-30; assess likelihood and impact, document rationale, and recommend mitigation or remediation.
• Perform vulnerability scans and configuration compliance checks against standards such as DISA STIGs and CIS Benchmarks, and document the results.
• Analyze FedRAMP security packages to document and assess customer responsibility for cloud-based services.
• Review monthly continuous monitoring deliverables from Cloud Service Providers and annual assessments from third-party assessors (3PAOs) to support FedRAMP requirements and ensure cloud services maintain an appropriate risk posture.
• Create, track, and manage system Plans of Action and Milestones (POA&Ms).
• Attend project meetings and collaborate with stakeholders to ensure security is addressed throughout the system lifecycle.

What This Job Offers

• Job Type: Full-time