Information Security Analyst/Senior - Point Mugu, CA

F3EA Inc

4h•Onsite

About The Position

F3EA is seeking a Senior Information Security Analyst to support Blue Water Instrumentation (BWI) RDT&E Tranche 1 operations at the Point Mugu Sea Range. This role is responsible for the assessment, monitoring, and compliance reporting of cybersecurity controls across R&D test environments, prototype systems, developmental networks, and data pipelines supporting maritime instrumentation, telemetry, Command-and-Control experimentation, and AI-Driven Instrumentation (AIDI) activities. The Senior Information Security Analyst will assess security posture, validate compliance, track POA&M burndown, and report findings to program leadership and Government stakeholders. This role operates under the guidance of the program’s ISSM or ISSE and focuses on analysis, assessment, and documentation rather than system design or security architecture. The analyst coordinates with Government cybersecurity authorities on test environment authorizations in a contractor support capacity. Continuous monitoring and compliance activities are scaled to developmental use and tied to scheduled RDT&E event windows rather than enterprise-grade 24/7 operations. This position ensures that security compliance is continuously assessed and clearly communicated, enabling informed risk decisions without impeding innovation, prototyping, and testing.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent combination of education and experience)
10+ years of experience in cybersecurity analysis, information assurance, compliance, or information security assessment roles within DoD/DoN environments
Strong working knowledge of DoD cybersecurity frameworks: RMF (DoDI 8510.01), NIST SP 800-53, NIST SP 800-171, CNSSI 1253, and DoD Zero Trust Reference Architecture
Demonstrated experience supporting IATT and ATO processes and managing RMF artifacts, inheritance mappings, and POA&Ms within eMASS
Hands-on proficiency with ACAS/Tenable Nessus, SCAP Compliance Checker (SCC), and DISA STIG Viewer
Experience with SIEM platforms (Splunk preferred) for security event monitoring and analysis
Familiarity with DoD Cloud Security Requirements Guide (SRG) and compliance assessment of cloud-based test environments (IL4/IL5/IL6)
Strong understanding of security control assessment methodologies per NIST SP 800-53A
Familiarity with POA&M management, continuous monitoring processes, and compliance reporting
Understanding of COMSEC compliance validation requirements
Strong analytical, written communication, and briefing/presentation skills
Ability to work independently, prioritize competing assessment deadlines, and make risk-informed recommendations
U.S. citizenship required
Active DoD Secret clearance required; TS/SCI eligibility preferred; must be eligible for SAP access based on tasking
One or more of the following, commensurate with IAM Level II/III:
CISSP (Certified Information Systems Security Professional)
CISM (Certified Information Security Manager)
CASP+ (CompTIA Advanced Security Practitioner)
Security+ CE (minimum for IAM Level II)

Nice To Haves

Experience supporting DoD test ranges, RDT&E programs, NAWCWD, NAVAIR, or Point Mugu Sea Range environments
Experience assessing developmental, prototype, or field-deployable systems at TRL 4–6
Familiarity with CMMC 2.0 Level 2 requirements and contractor compliance assessment
Familiarity with cross-domain solution (CDS) compliance requirements
Knowledge of TEMPEST/EMSEC compliance considerations in range environments
Experience with OT/IT convergence security assessment in instrumentation, telemetry, or USV/autonomous platform networks
Familiarity with DoD Cloud SRG IL6 compliance assessment
Familiarity with IRIG-106 and T&E range data standards
Experience with EO 14028 compliance assessment in DoD environments
COMSEC compliance validation experience
ITAR/EAR data handling compliance requirements familiarity
Experience supporting FMS (Foreign Military Sales) program security requirements
Additional certifications: CAP (Certified Authorization Professional), CISA, CEH, CCSP, Tenable Certified, Splunk Core Certified User

Responsibilities

Assess system configurations and validate compliance of R&D test environments and prototype systems with DoD cybersecurity requirements (RMF per DoDI 8510.01, NIST SP 800-53, CNSSI 1253, DoD Zero Trust Reference Architecture, and EO 14028)
Conduct scheduled and ad-hoc vulnerability scans using ACAS/Tenable Nessus and SCAP Compliance Checker (SCC) scaled to developmental use; analyze results and produce findings reports with remediation recommendations
Validate DISA STIG compliance across Windows, Linux, and network infrastructure in R&D test environments using STIG Viewer; document deviations and track remediation
Support development, review, and maintenance of IATT and limited ATO authorization package artifacts within eMASS, including SSPs, POA&Ms, risk assessments, and inheritance mappings (CDRL A007)
Develop and maintain security control inheritance mappings identifying which controls inherit from the range/enclave authorization versus system-specific implementations
Own POA&M burndown tracking and reporting as a primary deliverable tied to PRS metrics; coordinate remediation timelines with engineering and IT teams
Monitor systems for security events and anomalies using SIEM tools (Splunk or equivalent) during scheduled RDT&E event windows; escalate and document incidents per established IR procedures
Conduct security control assessments per NIST SP 800-53A; document assessment results and maintain assessment evidence for R&D test environments
Assess cybersecurity compliance of DoD Cloud SRG-aligned test environments, including IL6 and other applicable impact levels supporting AIDI/data pipelines
Maintain comprehensive documentation of security controls, compliance status, risk posture, residual risk mitigations, and continuous monitoring activities scaled to developmental use
Support audit readiness by preparing compliance packages, briefings, and evidence for NAVAIR, NAWCWD, and other Government stakeholders
Review and validate security configurations proposed by engineering teams; provide risk analysis and compliance feedback
Validate proper handling, marking, and protection of CUI, COMSEC material, ITAR/EAR-controlled technical data, and distribution-limited information per applicable policy
Coordinate with Government cybersecurity authorities (ISSM, AO, SCA) on test environment authorizations in a contractor support capacity
Support CAC/SAAR process compliance validation and PKI/email encryption compliance per DoD policy
Generate recurring and ad-hoc security posture reports, metrics dashboards, POA&M burndown reports, and compliance scorecards for program and Government leadership
Maintain current knowledge of emerging threats, vulnerabilities, and changes to DoD/DoN cybersecurity policy; advise program leadership on impacts to R&D test environments