Principal Consultant

Infosys

1d•$118,776 - $221,065

About The Position

Infosys Public Services is seeking a Cyber Security Analyst. The role focuses on cybersecurity Governance, Risk and Compliance (GRC), the NIST Risk Management Framework (RMF), Security Assessment and Authorization (SA&A), and Authorization to Operate (ATO) activities in U.S. federal, state, and local government environments. The consultant assesses security posture, conducts security and risk assessments, identifies compliance gaps, develops and assesses security controls, and supports remediation and authorization in alignment with FISMA, NIST standards, FedRAMP, CMMC, and applicable government security and privacy requirements. The role supports preparation of ATO package artifacts, including System Security Plans, security procedures and design artifacts, security risk assessments, and Plans of Action and Milestones. The consultant works with system owners, ISSOs, ISSMs, security architects, cloud and infrastructure teams, auditors and assessors, and government stakeholders to help ensure security requirements are implemented and maintained throughout the system lifecycle. The position requires at least 11 years of cybersecurity experience and a bachelor's degree or foreign equivalent from an accredited institution. Three years of progressive, relevant work experience may be considered instead of each year of education; candidates with a completed master's degree are strongly preferred. The work involves sitting at a computer for extended periods and communicating by telephone, email, or face-to-face. Travel may be required. The estimated annual compensation range in Rockville, Maryland, is $118,776 to $221,065.

Requirements

At least 11 years of cybersecurity experience.
Demonstrated experience supporting U.S. federal, state, local government, or regulated public-sector environments.
Strong experience with NIST RMF, FISMA, security assessment and authorization, ATO processes, NIST SP 800-53, NIST SP 800-171, IRS 1075, CJIS, CMS MARS-E, HIPAA/HITECH, FedRAMP, security risk assessments, GRC, cloud security, Zero Trust, vulnerability management, security operations, and incident management.
Experience supporting RMF lifecycle activities, security authorization, control assessment, authorization packages, and continuous monitoring.
Strong understanding of FISMA and associated NIST standards applicable to federal information systems.
Experience implementing and assessing security controls related to NIST SP 800-53, IRS 1075, FISMA, and FedRAMP, and documenting control effectiveness and deficiencies.
Experience developing SSPs, SAPs, SARs, POA&Ms, risk assessments, control implementation documents, and authorization artifacts.
Experience assessing security configurations and controls across Microsoft Azure, AWS, or other government cloud environments.
Experience applying Zero Trust principles across identity, endpoint, network, application, workload, and data security.
Experience with IAM architecture and implementation and access governance.
Experience with SIEM/SOAR SOC operations, security monitoring, threat detection, endpoint security, and operational security controls.
Experience supporting incident response activities, including triage, investigation, containment, remediation, recovery, reporting, and lessons learned.
Experience evaluating vulnerabilities, prioritizing risk, coordinating remediation, and maintaining vulnerability and POA&M tracking.
Experience supporting continuous security control monitoring, vulnerability assessment, configuration compliance, and risk reporting.
Ability to evaluate cloud, infrastructure, network, application, identity, and data architectures against government security requirements.
Experience supporting privacy assessments and security controls for sensitive government information, PII, and regulated data.
Ability to collaborate effectively with government stakeholders, system owners, ISSOs, ISSMs, Authorizing Officials, assessors, auditors, and technical delivery teams.
At least one of the following certifications: CISSP, CISM, CISA, CRISC, CCSP, GIAC, or Microsoft Azure Security certification, or an equivalent industry certification.
Bachelor's degree or foreign equivalent from an accredited institution; three years of progressive, relevant work experience may be considered instead of each year of education.
Ability to sit and work at a computer for extended periods and communicate by telephone, email, or face-to-face.

Nice To Haves

Microsoft Azure Security certification or equivalent industry certification is highly desirable.
Completed master's degree program is strongly preferred.

Responsibilities

Assess security posture and conduct security and risk assessments in public-sector environments.
Identify compliance gaps and develop, implement, and assess technical, operational, and management security controls.
Support NIST RMF lifecycle activities, security authorization, control assessment, ATO processes, and continuous monitoring.
Prepare and maintain authorization artifacts, including SSPs, SAPs, SARs, POA&Ms, risk assessments, control implementation documents, security procedures, and security design artifacts.
Assess security configurations and controls in Azure, AWS, or other government cloud environments.
Apply Zero Trust principles across identity, endpoint, network, application, workload, and data security.
Support IAM architecture, implementation, and access governance.
Support security operations, including SIEM/SOAR and SOC operations, security monitoring, threat detection, endpoint security, and operational security controls.
Support incident triage, investigation, containment, remediation, recovery, reporting, and lessons learned.
Evaluate vulnerabilities, prioritize risk, coordinate remediation, and maintain vulnerability and POA&M tracking.
Support continuous control monitoring, vulnerability assessment, configuration compliance, and risk reporting.
Evaluate cloud, infrastructure, network, application, identity, and data architectures against government security requirements.
Support privacy assessments and security controls for sensitive government information, PII, and regulated data.
Collaborate with government stakeholders, system owners, ISSOs, ISSMs, Authorizing Officials, assessors, auditors, and technical delivery teams.
Travel as required by job requirements.