Sr. Cybersecurity Analyst II

MetroStar•Washington, DC

6d•$150,000 - $160,000

About The Position

As Sr. Cybersecurity Analyst II, you’ll be responsible for spearheading the Assessment and Authorization (A&A) lifecycle, leading Risk Management Framework (RMF) processes, strictly utilizing eMASS to develop comprehensive system security plans, assessing complex security controls, and managing Plans of Action and Milestones (POA&Ms). The Senior Certification and Accreditation Specialist (Level III) is also responsible for successfully securing and maintaining Authorities to Operate (ATOs) for mission-critical enclaves. We know that you can’t have great technology services without amazing people. At MetroStar, we are obsessed with our people and have led a two-decade legacy of building the best and brightest teams. Because we know our future relies on our deep understanding and relentless focus on our people, we live by our mission: A passion for our people. Value for our customers. If you think you can see yourself delivering our mission and pursuing our goals with us, then check out the job description below!

Requirements

Active DoD Secret Clearance.
7 years of specialized Risk Management Framework/Assessment & Authorization experience.
Bachelor's degree in an IT discipline (Master's degree preferred).
Must have a current relevant IAT Level III certification such as CISSP or CISM.
Expert proficiency in eMASS for building assessment packages, managing security controls, and generating monthly POA&M reports.
Hands-on experience analyzing ACAS scans, managing VRAM environments, and tracking FISMA/IAVA compliance.
In-depth knowledge of Navy SCA/NAO procedures and experience registering systems in DADMS and DITPR-DON.
Must hold a current Fully Qualified Navy Validator (FQNV) Level II or III certification.

Nice To Haves

Master's degree preferred.

Responsibilities

Acquire technical inputs by collaborating with SMEs, attending stakeholder meetings, and researching system architecture to develop and maintain required RMF process and SDLC documentation.
Provide independent verification and validation of security controls and safeguards for Navy Secretariat systems throughout the assessment and authorization lifecycle.
Validate assigned cybersecurity controls, develop and execute rigorous test procedures, and accurately document testing results in alignment with Navy SCA guidelines.
Perform validation steps, compare actual against expected security baselines, analyze risk impacts, and record findings directly within government repositories like eMASS.
Conduct risk scoring, build Security Assessment Reports (SARs), and coordinate with the ISSM, Program Managers, and Navy Authorizing Official (NAO) to achieve and maintain system ATOs.
Develop and track A&A metrics—including RMF step completion rates and open security control findings—for inclusion in biweekly and monthly status reports.