Senior Information Assurance Analyst / Program Manager

Lucayan Technology Solutions LLC

9d•Remote

About The Position

Lucayan Technology Solutions LLC is seeking a Senior Information Assurance (IA) Analyst / Program Manager to support the Headquarters, Department of the Army G-1, Directorate of Prevention, Resilience, and Readiness (DPRR) Information Assurance Support Services (IASS) program. This key personnel role leads the Information Assurance program for the Drug and Alcohol Management Information System (DAMIS), the Risk Reduction Unit Risk Inventory Application, and associated standalone applications hosted in the cArmy Azure Cloud. The position serves as the Information Assurance Security Officer (IASO) and the Contracting Officer Representative's (COR) main point of contact, owns Risk Management Framework (RMF) compliance, continuous monitoring, and Authority to Operate (ATO) maintenance and reauthorization, and supervises the IA Analyst. This is a US-based remote position with occasional on-site visits to Arlington, Virginia, as required; travel is at the employee's expense. Core hours are 7:30 a.m. to 4:30 p.m. Eastern Time, Monday through Friday. No security clearance is required, but an active favorably adjudicated Tier 3 (NACI) or higher federal background investigation is required before starting, along with the ability to obtain and maintain a DoD Common Access Card (CAC).

Requirements

Bachelor's degree in computer science, cybersecurity, or a related field.
At least 6 years of technical and compliance experience maintaining a system's security posture and managing security within a Microsoft Azure IaaS environment.
At least 2 years of experience leading teams.
IA/cybersecurity experience managing the security posture of systems involving .NET, Windows, Azure, Oracle, and Red Hat.
Strong background in data architecture, the SDLC, and Red Hat and Windows security and administration.
Extensive experience implementing and auditing against DISA STIG checklists to oversee RMF processes and continuous monitoring.
Demonstrated ability to maintain a system's ATO and obtain a new ATO.
Experience using eMASS.
Strong technical writing, organizational, and communication skills, and the ability to work effectively with technical staff, program leadership, and Government stakeholders.
Active favorably adjudicated Tier 3 (NACI) or higher federal background investigation before starting.
Ability to obtain and maintain a DoD CAC.
DoD 8570 IAM Level II certification (such as CISSP, CGRC/CAP, CISM, or GSLC) required at hire and maintained throughout employment.
DoD 8570 IAT Level II certification (such as Security+ CE, CySA+, or GSEC) required at hire and maintained throughout employment. CISSP satisfies both IAM Level II and IAT Level II.

Nice To Haves

Experience with ACAS, SCAP Compliance Checker, and DISA STIG Viewer.
Experience supporting systems through RMF changes such as the transition from NIST SP 800-53 Revision 4 to Revision 5.
Experience supporting Army systems hosted in the cArmy Azure Cloud.
Experience with systems handling Privacy Act, PII, or HIPAA-protected data.
Experience with FISMA reporting in APMS and A&VTR.

Responsibilities

Lead the overall Information Assurance program for DAMIS under the direction of the System Owner/COR and the Program Information Systems Security Manager (P-ISSM), serving as IASO and the COR's main point of contact.
Manage the system's RMF process; prepare, coordinate, and submit security documentation for review and routing to the approving authority, adapting to changing requirements from TBAI, Army CIO, or DoW.
Use eMASS to obtain and maintain the system ATO; perform weekly continuous monitoring of ATO requirements, STIGs, and CCIs, and report weekly ATO status with a remediation plan.
Develop and maintain the RMF modernization and timeline plan with ATO milestones, and prepare and submit the ATO reauthorization package in eMASS before the current ATO expires.
Manage the vulnerability compliance report and lead annual contingency, security, and recovery tests, submitting documentation within two business days of test completion.
Prepare FISMA-compliant reports and update information assurance data in APMS, A&VTR, and eMASS.
Prepare and submit the Monthly Status Report (MSR) on RMF compliance, challenges, issues, and prior-month activity.
Serve as a member of the agency's Computer Emergency Response Team (CERT), acknowledge incidents within 15 minutes, initiate approved mitigation within one hour during duty hours, and maintain the Emergency Operations Plan.
Review system change requests and recommend implementation or alternatives based on IA vulnerabilities within two business days.
Attend IA working groups, conferences, and recurring meetings virtually or in person, and provide minutes and recommendations within two business days.
Supervise the IA Analyst, review deliverables for quality, and provide backup coverage for IA Analyst tasks.