Senior Cyber Security Analyst

Description The SRC Navy Cryptologic Systems (NCS) Directorate supports a number of U.S. Navy Programs, including the Cryptologic Carry-On Program (CCOP), Ships Signals Exploitation Equipment (SSEE) Program, and Distributed Common Ground System – Navy (DCGS-N). We specialize in engineering support, software development, integration, testing, technical writing, cybersecurity (administration, policy and engineering), production, technical support, warehousing, drafting, repair and management. The Information Systems Security Officer (ISSO) supports the security authorization and continuous monitoring of NCS Family of Systems in accordance with applicable NIST, DoD, Navy, and NAVINTEL cybersecurity requirements. The ISSO is responsible for independently managing assigned systems' RMF activities, maintaining authorization documentation, tracking security compliance, coordinating remediation efforts, and ensuring security requirements are met throughout the system lifecycle. Responsibilities include: Developing, reviewing, and maintaining A&A documentation and the system Body of Evidence to support initial authorization, ongoing compliance, and continuous monitoring activities Executing and maintaining RMF activities in Xacta, including security control implementation status, assessment results, supporting evidence, POA&Ms, remediation actions, and authorization package updates Managing assigned systems' security posture and authorization status, identifying compliance gaps, tracking security risks, and coordinating corrective actions to maintain compliance with applicable requirements Conducting and coordinating security compliance assessments using tools and processes such as ACAS/Nessus, Security Content Automation Protocol (SCAP), DISA STIGs, and applicable endpoint protection and security monitoring solutionsReviewing vulnerability assessment results, security findings, configuration compliance, patch status, and other security metrics; coordinating corrective actions with system owners, system administrators, ISSEs, engineers, and developers Managing POA&Ms from identification through closure, including documenting findings, tracking remediation milestones and due dates, validating supporting evidence, and escalating overdue items and unresolved risks as appropriate Supporting the implementation, assessment, and continuous monitoring of technical and operational security controls in accordance with applicable security policies and system requirements Reviewing security events, audit findings, and available security monitoring data to identify potential indicators of compromise, suspicious activity, unauthorized access, or inappropriate data transfers; coordinating investigation and reporting as required Ensuring proposed system changes, software installations, and configuration modifications follow established configuration management, change management, and security approval procedures Supporting and, when formally authorized and qualified, performing Site Based Security Assessments (SBSAs) and providing security assessment results and authorization recommendations to the Designated Authorizing Official (DAO) or other designated government authority Reporting and coordinating security incidents in accordance with the applicable Command Incident Response Plan (CIRP) and established reporting requirements Advising system stakeholders on cybersecurity compliance, authorization requirements, security risks, remediation priorities, and required corrective actions Maintaining accurate security records, tracking authorization milestones, and providing status reports to government and program leadership Ensuring assigned systems are operated, maintained, and disposed of in accordance with applicable security policies, procedures, and authorization conditions #LI-LL1 Requirements Minimum of five years of relevant cybersecurity, Information Assurance (IA), or information systems security experience, including experience performing ISSO or equivalent RMF responsibilities Must meet applicable DoD 8140 qualification requirements for the assigned cybersecurity work role, including the required IAT Level II certification (e.g., Security+ CE or another approved certification, as applicable) Working knowledge and practical experience with Risk Management Framework (RMF) Revision 4 and Revision 5 processes, workflows, security control implementation, assessment, authorization, and continuous monitoring Demonstrated experience independently executing and managing RMF activities for assigned information systems through authorization and continuous monitoring, including security control implementation and assessment, Assessment and Authorization (A&A) documentation, evidence management, and authorization package maintenance Experience developing, reviewing, maintaining, and updating System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), security assessment evidence, vulnerability assessment results, and other applicable Assessment and Authorization (A&A) artifacts Experience with ACAS/Nessus, DISA Security Technical Implementation Guides (STIGs), and eSTIG assessment and remediation processes Demonstrated proficiency using Xacta to manage assigned systems' RMF activities, including documenting and updating security control implementation and assessment status, maintaining assessment evidence, identifying and tracking noncompliant and nonvalidated controls, managing POA&Ms, maintaining authorization status, and generating reports Demonstrated experience managing POA&Ms from identification through closure, including documenting findings and risks, developing and tracking remediation milestones, coordinating corrective actions with system administrators, Information Systems Security Engineers (ISSEs), engineers, and developers, validating closure evidence, monitoring due dates, and escalating overdue or unresolved findings Demonstrated abil