Information Security Analyst Sr Principal

GD Information Technology•Sterling, VA

21h•Onsite

About The Position

The Information Security Analyst Sr Principal supports a federal government customer by helping achieve and sustain Authorization to Operate (ATO) for enterprise systems. The role is part of an Assessment & Authorization (A&A) team and works across all phases of the NIST Risk Management Framework, with a focus on cloud technologies and Commercial Solutions for Classified (CSfC). The analyst develops Security Impact Analyses for system changes and maintains security documentation, including the System Security Plan, Information Security Contingency Plan, and other security artifacts. The role coordinates with federal officials to obtain and maintain ATO and ensures compliance with federal regulations and privacy requirements. It also involves investigating security violations, incidents, and vulnerabilities; reporting findings to management; and conducting periodic and ad-hoc system audits and vulnerability assessments. The analyst participates in Change Management and collaborates with cross-functional teams, customers, and stakeholders to keep IT systems compliant with security requirements. This is an onsite role in Sterling, Virginia, with travel required at less than 10%.

Requirements

At least 8 years of related experience.
Technical training, certifications, or a degree.
Experience in information system security, IT risk management, cybersecurity, compliance, and Change Management.
Experience with security control statements and security documentation.
Experience with JCAM, Archangel, or Xacta.
Active Secret clearance; the posting also lists Top Secret as preferred.
U.S. citizenship required.
Ability to work onsite in Sterling, Virginia, and travel less than 10%.

Nice To Haves

Top Secret clearance.

Responsibilities

Support achievement and maintenance of Authorization to Operate (ATO) for enterprise systems.
Participate in all phases of the NIST Risk Management Framework, including categorizing information and system components, conducting Privacy Impact Assessments, developing risk management strategies, and creating and maintaining security documentation.
Develop Security Control Implementation Statements and gather information for security controls, policies, and process documentation.
Develop, track, and follow up on Plans of Action and Milestones (POAM).
Develop Security Impact Analyses for system changes and update the System Security Plan, Information Security Contingency Plan, and other security artifacts.
Coordinate with Federal Government officials to obtain and maintain the system’s ATO.
Ensure compliance with federal regulations and privacy requirements.
Investigate information system security violations, incidents, and vulnerabilities, and report findings to management as necessary.
Conduct periodic and ad-hoc system audits and vulnerability assessments, including reviews of system scans, audit logs, user accounts, application access, file system integrity, and compliance-related configurations.
Use governance, risk, and compliance tools such as JCAM, Archangel, or Xacta.
Participate in the Change Management process.
Collaborate with cross-functional teams, customers, and stakeholders on projects to ensure IT systems remain compliant with security requirements.

Benefits

Medical plan options, including some with Health Savings Accounts.
Dental plan options.
Vision plan.
401(k) plan with company match.
Flexible work weeks where possible.
Paid time off, including vacation, sick and personal time, holidays, and paid parental, military, bereavement, and jury duty leave.
Short- and long-term disability benefits.
Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance, provided or available.
Wellness packages.
Career growth and learning opportunities through an AI-powered career tool.
Internal mobility support.
Competitive pay.