SCI Clearance)

SBS•Chantilly, VA

17h•Onsite

About The Position

Strategic Business Systems (SBS) is expanding its cybersecurity team and hiring Senior Security Analysts to support our growing Authority to Operate as a Service (ATOaaS) offering. SBS developed ATOaaS in collaboration with leading technology companies and DoD/Intelligence Community customers to help accelerate the process of bringing innovative commercial technologies into secure government environments. This is a hands-on cybersecurity role supporting technology partners and government customers throughout the Authority to Operate (ATO) and Risk Management Framework (RMF) lifecycle. You’ll work directly with customers to understand their technologies, develop security documentation, assess vulnerabilities, implement and document security controls, manage POA&Ms, and help move cloud-based solutions successfully through authorization. The goal is straightforward: help technology providers navigate the government security authorization process faster while maintaining the security and compliance required for mission environments. If you have experience developing ATO packages, understand RMF, and enjoy working directly with customers to solve cybersecurity and compliance challenges, this is a strong fit.

Requirements

Active TS/SCI clearance required
Active Security+ or higher (IAT Level II/III) certification required
Hands-on experience supporting and/or managing ATO packages for cloud-based products
Experience supporting solutions used by U.S. government agencies and/or military organizations
Strong experience with ATO writing, security documentation, and package development
Hands-on knowledge of the Risk Management Framework (RMF)
Understanding of all RMF lifecycle steps
Experience assessing security controls against NIST 800-53
Experience developing and managing POA&Ms
Ability to understand and explain security-control inheritance
Experience identifying and mitigating open-day vulnerabilities
Experience reviewing and interpreting vulnerability scans
Knowledge of STIGs and SCAP
Experience with vulnerability and application-security tools such as Tenable Nessus, Checkmarx, Fortify, or similar platforms
Ability to recommend appropriate countermeasures and mitigating controls
Experience supporting continuous monitoring and compliance reporting
Experience assessing the security posture of cloud-based environments and products
Understanding of cloud security controls, configurations, and compliance requirements
Ability to evaluate configuration changes and determine their potential security impact
Strong technical writing and documentation skills
Ability to explain cybersecurity risks and requirements to both technical and non-technical stakeholders
Comfortable leading customer meetings and technical discussions
Ability to translate cybersecurity findings into actionable remediation recommendations
Self-motivated and comfortable working within a small, agile technical team
U.S. Citizenship required

Nice To Haves

CI Polygraph preferred but not required
CISSP or similar information security certification preferred
Cloud security or platform certifications are a plus
Bachelor’s degree preferred
Familiarity with firewalls, network security, and intrusion detection systems (IDS) in cloud environments is preferred

Responsibilities

Support customers through the complete ATO and RMF lifecycle
Develop and maintain ATO security packages and authorization documentation
Write clear technical documentation describing how systems are configured, secured, and operated
Work across the RMF lifecycle, including Categorize, Select, Implement, Assess, Authorize, and Monitor
Assess security controls against NIST 800-53 requirements
Analyze STIG and SCAP requirements and document compliance
Review vulnerability scans and identify security weaknesses within customer environments
Interpret results from tools such as Tenable Nessus, Checkmarx, and Fortify
Develop, manage, and update Plans of Action & Milestones (POA&Ms)
Track vulnerabilities through remediation, mitigation, or risk acceptance
Identify and help customers remediate open-day vulnerabilities
Evaluate configuration changes and their impact on the security posture of enterprise cloud solutions
Recommend mitigating controls and security countermeasures
Support continuous monitoring following authorization
Maintain security documentation as customer environments and requirements evolve
Explain security-control inheritance models and associated resources
Prepare documentation for system audits and vulnerability assessments
Communicate cybersecurity risk and remediation recommendations to technical teams and senior leadership
Lead technical discussions with customers and technology partners
Understand customer systems, architectures, and business requirements
Translate technical environments into appropriate security controls and authorization requirements
Advise customers on security best practices and required remediation
Identify technical and cybersecurity risks and recommend mitigation strategies
Participate in project planning and identify risks, dependencies, and deliverables
Develop project artifacts and support Work Breakdown Structures (WBS)
Communicate project status, risks, and technical requirements to project leadership
Provide guidance and technical leadership to customers and less-experienced security staff

Benefits

Comprehensive medical, dental, and vision coverage; HSA-eligible plan options available
401(k) retirement plan with company match (vesting schedule per Plan Document)
Paid Time Off, federal holidays, and floating holiday for personal observance
Annual professional development support for AWS certifications, training, and conferences
Employee referral program where applicable and documented by program policy
Life, AD&D, and short- / long-term disability insurance
Telework and flexible-schedule support where mission and contract permit

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume