Senior Cyber Security Analyst

Strategic Growth Partners•Washington, DC

3d•Hybrid

About The Position

Strategic Growth Partners is recruiting a Senior Cyber Security Analyst for its client, a leading global professional services firm. The role is within the Corporate Performance Improvement practice and supports client cyber security assessments, risk remediation, and security program transformation in complex threat and regulatory environments, including federal and defense settings. The analyst supports cyber and identity workstream leads and is expected to investigate, analyze, and remediate security issues at scale, rather than only monitor existing environments. The position includes supporting cybersecurity assessments and remediation, security operations and incident response processes, Zero Trust and IAM readiness, ICAM modernization, continuous control monitoring, and authorization maintenance. It also involves analyzing dependencies between security remediation and technology or cloud migration initiatives, contributing to program readouts and client deliverables, and supporting practice development through internal knowledge sharing and content creation. The role is hybrid and requires travel up to 60%. An active Secret clearance and U.S. citizenship and residency are required; TS/SCI eligibility is strongly preferred. Compensation is an hourly rate determined by experience.

Requirements

At least 4 years of professional cybersecurity experience in complex, large enterprises.
Demonstrated experience supporting security assessments, incident response engagements, or compliance remediation efforts.
Bachelor's degree required.
Active Secret Clearance required.
U.S. citizenship and residency required.
Comfortable traveling up to 60%.
Experience should include security assessment support and GRC frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, CIS Controls, SOC 2, and DoD RMF, including ATO packages.
Experience with threat detection and incident response, including hands-on SIEM/SOAR platforms, log analysis, and incident triage.
Experience with vulnerability management and penetration testing support, including scanning, findings analysis, remediation tracking, and DISA STIG compliance.
Knowledge of IAM, Zero Trust architecture, and PAM concepts, including the DoD Zero Trust Strategy and Reference Architecture.
Cloud security posture experience across AWS, Azure, and/or GCP, including container and workload protection basics and DoD cloud impact levels IL2 to IL6.
Regulatory and compliance exposure, including DoD frameworks such as RMF, DISA STIGs, and the DoDI 8500 series; HIPAA, PCI DSS, GLBA, or GDPR experience can substitute.
Baseline competency with AI-assisted threat detection and analysis tools, and ability to articulate how AI accelerates security analysis and investigations.
Vendor and third-party risk review experience, including security questionnaires and control validation.
Experience supporting security awareness and phishing simulation programs, including content and metrics reporting.
Experience with ICAM for large enterprises, including PKI, CAC and derived credentials, and application onboarding to enterprise identity services.
Experience with continuous monitoring and continuous compliance, including NIST SP 800-137, the RMF Monitor step, cATO, POA&M management, and risk acceptance.
Experience with automated compliance tooling, such as eMASS, Xacta, ServiceNow GRC, or Archer; automated evidence collection; SCAP/OSCAL; and continuous scanning and configuration drift detection such as ACAS and CDM.
Experience with compliance as code and DevSecOps, including policy-as-code, controls embedded in CI/CD pipelines, and the DoD Enterprise DevSecOps approach.

Nice To Haves

Consulting or advisory delivery experience.
Government or defense experience; regulated industry experience in financial services or healthcare, or deep experience in other complex environments, may substitute.
Security+, CySA+, GSEC, or equivalent certification; Security+ meets the DoD 8140 baseline.
CISSP, CISM, CAP, CISA, or CCSP certification.
TS/SCI eligibility.
Exposure to cyber sensing and analytics and to quantum-readiness (post-quantum cryptography) planning.
AI-assisted security analysis integrated into delivery practice.
Hands-on experience analyzing and remediating security issues at scale.
Ability to understand dependencies between security readiness and broader technology transformation, and to work across security, infrastructure, and compliance teams.
Experience building sustained compliance through continuous monitoring and automated evidence rather than point-in-time audits.

Responsibilities

Support cybersecurity assessments, including control gap analysis, evidence gathering, and remediation tracking.
Assist in designing security operations processes, including incident response playbooks and escalation procedures.
Assess Zero Trust and IAM readiness and support development of implementation roadmaps aligned with compliance timelines.
Analyze dependencies between security remediation and broader technology or cloud migration initiatives.
Support ICAM modernization, including onboarding backlog analysis and process streamlining.
Support readouts of in-flight cyber and identity programs, capturing leadership, resources, financials, schedules, and obstacles.
Build and support continuous control-monitoring programs, including control testing cadence, automated evidence collection, and compliance dashboards and KPIs tracking control effectiveness and audit readiness over time.
Support authorization maintenance, including POA&M lifecycle management, significant-change reviews, reauthorization triggers, and ongoing third-party assurance.
Contribute findings and analysis to A&M's broader engagement scope and deliverables.
Support practice development through internal knowledge sharing and content creation.