Senior Information Security Analyst DoS CSS

OneZero Solutions•Washington, DC

1d•Remote

About The Position

The Senior Information Security Analyst serves as ISSO of record for an assigned portfolio of approximately 6–8 Moderate-baseline consular systems. The Senior Analyst owns each system's authorization package and continuous monitoring cadence end to end, leads the system's triennial RMF cycle, directs technical remediation by system operations teams, and provides day-to-day direction to Information Assurance Analysts supporting the portfolio.

Requirements

Seven (7)+ years of information security experience, including four (4)+ years as an ISSO or in an equivalent A&A role for federal information systems.
Demonstrated experience authoring SSPs, POA&Ms, contingency plans, and supporting authorization packages under NIST SP 800-37 / SP 800-53 Rev. 5.
One of: CISSP, CISM, CGRC/CAP, or CISA (DoD 8140/8570 IAM Level II or higher).
Active, final SECRET security clearance; U.S. citizenship.
Experience with an enterprise GRC tool and with interpreting vulnerability scan results.
Strong technical writing and stakeholder coordination skills.
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an additional four (4) years of directly relevant experience in lieu of degree.

Nice To Haves

Department of State (DT/CA/CST) experience; ArchAngel and iPost proficiency.
Experience with cloud or hybrid authorization boundaries and FedRAMP inheritance.
Experience conducting NIST SP 800-34 contingency plan tests and NIST SP 800-63 Digital Identity Risk Assessments.
Security+ CE, CySA+, or CCSP in addition to the required certification.

Responsibilities

Serve as ISSO of record and primary cybersecurity point of contact for an assigned portfolio of approximately 6–8 Moderate-baseline systems.
Execute RMF Steps 1–3 for assigned systems: categorization with CIA justification, baseline and overlay selection, tailoring rationale, Inherited Controls Matrix, SSP and Security Control Implementation Statements, Evidence Index, and Implementation Readiness Review.
Develop and maintain PIA, DIRA, ISA/MOU, Security Assessment Plan, POA&M, SIA, system inventory, IRP, CP/ISCP, CP Test report, and CMP for assigned systems; ensure CMPs are delivered into the GRC tool.
Set up and support Security Control Review Meetings and demos, collect and validate artifacts requested by the SCA, attend A&A Findings Meetings, and support remediation validation(RMF Step 4).
Maintain authoritative POA&Ms in theGRC tool (monthlyupdates and within 5 business days of status changes) with realistic milestones, accurate risk levels, and closure evidence attached (RMF Step 6).
Review iPost scores weekly; coordinate remediation with system and application teams; track and report findings open more than 30 days.
Review vulnerability, KEV, CVE, and STIG results within 5 business days; drive critical and high remediation within Department and BOD timelines; document in POA&Ms.
Conduct annual Contingency Plan tests and Annual Control Assessments; document results and lessons learned; update CP, ISCP, IRP, and CMP as needed.
Perform Security Impact Analyses for hardware, software, patch, and configuration changes; participate in CCB/ECM; contribute to the Quarterly Configuration and Change Impact Summary.
Coordinate incident reporting and documentation with the SOC and system owners; reflect outcomes in risk posture and POA&Ms.
Direct system-specific security operations contractors to obtain evidence and implement remediation; validate completion before POA&M closure.
Support audits and data calls (OIG, GAO, CISA, HVA, BOD, OMB, CDM) and maintain the Audit and Data Call Response Package for assigned systems.
Provide day-to-day direction and quality review for Information Assurance Analysts supporting the portfolio.