Senior Information Assurance Analyst

Data Systems Analysts•Fairfax, VA

2d•Hybrid

About The Position

DSA is hiring a Senior Information Assurance Analyst to support the Environmental Protection Agency (EPA), as part of the Cybersecurity, Privacy & Risk Management Division (CPRMD). The role contributes to the development and maturation of an agency-wide information security program for a large civilian federal agency. The analyst serves as a subject matter expert on the Risk Management Framework (RMF), related information security policies and procedures, and the application, selection, and testing of NIST security controls. The position is full-time and hybrid in the DC Metro area. The employee may work onsite at DSA or the customer site, with potential for telework as approved; the ability to work onsite each week is required. DSA work locations include Fairfax, Virginia. Core work hours are 8 a.m. to 5 p.m. Eastern Time. The role supports agency security and privacy programs, including policy, training, compliance, risk management, and security operations.

Requirements

Ability to obtain a Public Trust.
Bachelor’s degree in information technology or a related field and 8 years of relevant information assurance experience; a security certification such as CISSP may substitute for 2 years of experience.
Strong data analysis skills.
Excellent written and verbal communication skills.
In-depth knowledge of applying, selecting, and testing NIST 800-53 Rev. 5 security controls.
In-depth knowledge of the NIST 800-37 Risk Management Framework.
Experience with a Governance, Risk, and Compliance tool such as Xacta, RSA Archer, CSAM, or eMASS.
Excellent attention to detail.
Ability to handle and prioritize multiple tasks and deadlines.
Experience with Microsoft Copilot and/or an approved equivalent AI solution.

Nice To Haves

Advanced-level cybersecurity certification, such as CompTIA CISM or ISC2 CISSP.
3 or more years in a leadership role.

Responsibilities

Advise senior-level stakeholders on information security initiatives, including compliance, awareness and training, and security operations.
Lead Independent Validation and Verification (IV&V) efforts on security authorization/ATO packages to assess compliance with agency requirements.
Use a Governance, Risk, and Compliance (GRC) tool to track and reconcile findings from assessments, audits, and vulnerability scans.
Coordinate government data calls, including FISMA, FMFIA, and BDR, and prepare monthly reports.
Assess the effectiveness of the information security and privacy training program.
Lead the collection, analysis, and presentation of enterprise-level information security performance metrics.
Manage information security program POA&Ms and advise on remediation efforts.
Work with senior agency security officials, system owners, ISSOs, and other stakeholders to advise on and implement security solutions.
Identify opportunities to improve work-process efficiency and develop innovative approaches.
Participate in team problem-solving efforts and propose solutions to client issues.
Conduct relevant research and data analysis, and develop reports.
Prepare and assist with developing policies and procedures.
Implement processes and procedures to monitor risk across programs and projects.
Prepare executive briefings on the results of studies, analyses, and plans.
Assist client leadership with reviewing monthly project progress, documenting issues, and monitoring their resolution.