Cyber Security Analyst

Cherokee Federal•United States,

1d•$150,000 - $155,000•Remote

About The Position

The Senior Maritime Cybersecurity Analyst provides expert cybersecurity support to the MARAD Information Assurance Program, supporting system authorization, continuous monitoring, and Authority to Operate (ATO) activities for maritime information systems. This role works closely with MARAD program offices, Information System Owners, and ISSMs to manage security documentation, assess risk, support compliance with federal and maritime cybersecurity requirements, and strengthen the security posture of IT and OT systems supporting maritime operations. This position requires an active Public Trust clearance or the ability to obtain a Public Trust clearance to be considered. Applicant MUST have prior US Navy or Coastguard Maritime Cyber Security Experience.

Requirements

10+ years of experience in cybersecurity, with expertise in maritime/vessel cybersecurity, IT/OT security, and federal cybersecurity policies.
US Navy or Coastguard Maritime Cyber Security Experience highly desired.
Strong knowledge of NIST RMF, NIST Cybersecurity Framework (CSF), FISMA, and Navy or U.S. Coast Guard Maritime Organization cybersecurity requirements.
Experience with Continuous Diagnostics and Mitigation (CDM), Information Security Continuous Monitoring (ISCM), and Identity, Credential, and Access Management (ICAM).
Proven ability to lead cybersecurity assessments, compliance audits, and risk management activities.
Understanding of the principles, methods, and tools of quality assurance and quality control used to ensure a product fulfills functional requirements and standards.
Proficiency in Microsoft Office Suite, Power BI, Tableau, and SharePoint.
Must pass pre-employment qualifications of Cherokee Federal.
Must have an active Public Trust clearance or the ability to obtain one.

Nice To Haves

Maritime background desired.

Responsibilities

Provide support to the MARAD Information Assurance Program for operations, business and administrative in support of the System Authorization Process and deliverables as defined in this document.
Direct involvement with MARAD Program Office and the Information System Security Manager (ISSM) on cybersecurity and authority to operate (ATO) matters related to information systems supporting the MARAD CIO.
Background on Network Architecture, hardware, software, contingency planning and disaster recovery required.
Manage MARAD’s Information System’s core documentation, in accordance with each phase of the system engineering process / System Development Life Cycle (SDLC) with standardized templates, baseline management with supporting checklists and technical guides, including but not limited to the DOT Security Authorization and Continuous Monitoring Guide, Weakness Guide and other Core Documents.
Provide information system data for Privacy Impact Assessments (PIAs), Privacy Threshold Analyses (PTAs), and System of Record Notices (SORNs). This includes interfacing/coordinating with the System Owner (SO) that originates/has responsibility for the document to ensure the PIA/PTA/SORN contains appropriate information to be approved/adjudicated by DOT Privacy Office for inclusion in System Authorization package.
Support creation/update of FIPS 199 Security Categorization document; ensure information type(s) and special considerations (if applicable) are defined.
Support creation/update security control selection listing (include justification for applicable tailor and or risk acceptance).
Support creation/update System Security Plan (SSP); ensure discovered and identified system components, control implementation status are addressed.
Support creation/update Information System Configuration Management Plan.
Support creation/update Information System Account Management Plan.
Support creation/update Audit Log Monitoring Plan to Develop and Maintain Inventory of Information System Interconnections and review, Develop / update Interconnection Security Agreements and MOUs in accordance with NIST 800-47.
Support creation/update Risk Assessment and relevant impact rating pertaining within the scope of this statement of work.
Assist the Information System Owner (ISO), Business Sponsor, and Information System Security Manager (ISSM) in recording all known security weaknesses of assigned information systems in the Plans of Action and Milestones (POA&M’s) in accordance with DOT policy, guides and procedures.
Develop Draft Plan of Action and Milestones (POA&M) for observed control level deficiencies or gaps control implementation(s) in accordance with DOT policy, guides and procedures.
Support the information system contingency planning process in accordance with NIST SP 800-34 Revision (Current), Guide to Test, Training and Exercise Programs for MARAD information and ensure contingency plan test exercise results are documented in an after-action report, and Lessons Learned corrective actions are captured for updating information in the Information Systems Contingency Plan (ISCP).
Assist in security incident response, risk mitigation, and compliance reporting.
Performs other job-related duties as assigned.