Vulnerability Analyst

Leidos•Arlington, VA

19h•Onsite

About The Position

Leidos is seeking a Vulnerability Analyst to support the Compartmented Enterprise Services Office (CESO) effort. The program is establishing a modern secure web service operation on a highly automated platform and migrating to a high-security cloud environment. The position provides vulnerability management, risk assessment, and compliance services to protect the platform throughout its lifecycle. It is based in Arlington, Virginia, and is 100% onsite. An active TS/SCI U.S. Government security clearance is required to start.

Requirements

Bachelor's degree and at least 4 years of related IT security experience; additional experience, education, or training may be considered in lieu of a degree.
Active TS/SCI security clearance required.
DoDD 8140-compliant certification at minimum IAT Level II, such as Security+ CE, required at start.
Experience with DISA security models, controls, and authorization processes for standard computing systems and cloud computing across the Department of Defense.
Experience conducting activities associated with Information Assurance Vulnerability Alerts (IAVA), for example, CISA-related activities.
Experience creating Information Assurance documentation, including Security Control Traceability Metrics (SCTM), Risk Assessment Reports (RAR), and Security Assessment Reports (SAR), and maintaining Plans of Action and Milestones (POA&Ms).
Experience with ACAS and SIEM tools.
Experience with application and hardware security settings based on vendor and/or DISA best practices.

Nice To Haves

Prior experience with DISA and its support to mission partners.
TS/SCI clearance with CI Polygraph.
Experience with ACAS, Splunk, ACT (cybersecurity event), IAVA reporting, and eMASS.
Familiarity with vulnerability management across enterprise applications and infrastructure, including Oracle, SQL Server, Exchange, virtualization platforms, Windows, and Red Hat.
Understanding of disaster recovery and business continuity concepts as they apply to secure cloud migrations.

Responsibilities

Meet regulatory and non-regulatory compliance requirements across the CESO environment.
Assist in managing and maintaining the Information Assurance Vulnerability Alerts (IAVA) program for CESO systems.
Manage and enforce information security policies and educate end users on proper security practices.
Conduct security and risk assessments using established frameworks such as NIST, RMF, and Common Criteria.
Mitigate risk through security controls, testing, and evaluation to certify and accredit commercial security products used within the CESO platform.
Develop, update, organize, maintain, and track RMF documentation using customer-provided information.
Ensure data privacy throughout its lifecycle and perform vulnerability scanning, assessment, reporting, and mitigation verification.
Support business continuity and disaster recovery activities.
Coordinate vulnerability management activities with infrastructure, storage, database, and application teams to align with CESO operational and compliance requirements.
Maintain documentation, operational procedures, and compliance reports supporting CESO's secure cloud migration.
Protect information and maintain security controls across the CESO system, site, or program to reduce risk.