Vulnerability Analyst

Leidos • Arlington, VA

2d • $87,100 - $157,450 • Onsite

About The Position

Leidos is seeking a Vulnerability Analyst to support the Compartmented Enterprise Services Office (CESO) effort. CESO is establishing a modern secure web service operation on a highly automated platform for a growing customer population. The role supports CESO's migration to a high-security cloud environment by providing vulnerability management, risk assessment, and compliance services throughout the platform lifecycle. This position is based in Arlington, Virginia and is 100% on-site. An active TS/SCI U.S. Government security clearance is required to start.

Requirements

• Bachelor's degree and at least 4 years of related IT security experience; additional experience, education, or training may be considered in lieu of a degree.
• Active TS/SCI security clearance required at start.
• DoDD 8140-compliant certification at a minimum of IAT Level II (such as Security+ CE) at start.
• Experience with the Defense Information Systems Agency (DISA) security model, controls, and authorization processes for standard and cloud computing systems across the Department of Defense.
• Experience conducting activities associated with Information Assurance Vulnerability Alerts (IAVA), such as CISA-related activities.
• Experience creating Information Assurance documentation, including Security Control Traceability Metrics (SCTM), Risk Assessment Reports (RAR), and Security Assessment Reports (SAR), and maintaining Plans of Action and Milestones (POA&Ms).
• Experience with ACAS and SIEM tools.
• Experience with application and hardware security settings based on vendor and/or DISA best practices.

Nice To Haves

• Prior experience with DISA and its support to mission partners.
• TS/SCI clearance with CI Polygraph.
• Experience with ACAS, SPLUNK, ACT (cybersecurity event), IAVA reporting, and eMASS.
• Familiarity with vulnerability management across enterprise applications and infrastructure, such as Oracle, SQL Server, Exchange, virtualization platforms, Windows, and Red Hat.
• Understanding of disaster recovery and business continuity concepts as they apply to secure cloud migrations.

Responsibilities

• Meet regulatory and non-regulatory compliance demands across the CESO environment.
• Assist with management and maintenance of the Information Assurance Vulnerability Alerts (IAVA) program for CESO systems.
• Manage and enforce information security policies, and train and educate end users on security practices.
• Conduct security and risk assessments using frameworks such as NIST, RMF, and Common Criteria; mitigate risk through security controls, testing, and evaluation to certify and accredit commercial security products used on the CESO platform.
• Develop, update, organize, maintain, and track RMF documentation using customer-provided information.
• Ensure data privacy throughout its lifecycle; perform vulnerability scanning, assessment, reporting, and mitigation verification, as well as business continuity and disaster recovery activities.
• Coordinate vulnerability management activities with infrastructure, storage, database, and application teams to meet CESO operational and compliance requirements.
• Maintain documentation, operational procedures, and compliance reports supporting CESO's secure cloud migration.
• Protect information and maintain security controls across the CESO system, site, or program to reduce risk.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level