Cyber Security Analyst

Security Analyst in Arlington, VA

Posted 2020-01-09

The Cyber Security Analyst will provide expert consultation across a wide range of cross-functional areas of Cybersecurity (CS) services. The Cyber Security Analyst will provide project planning, guidance and technical expertise in the following areas: program, policy, process, and planning; risk management, auditing, and assessments; Assessment and Authorization (A&A); and quality planning and control of all products.

Duties and Responsibilities:

Develop and maintain a detailed policy matrix mapping Federal, DoD, and local policies to the required security controls as identified by National Institute of Standards and Technology (NIST) SP 800-53 and DoDI 8510.01. Documents include but are not limited to:
Standard Operating Procedures (SOPs)
Agency Training (e.g., cyber awareness, computer incidents, malicious codes, etc.)
Contingency Plan
Security Assessment Report (SAR)
Cybersecurity Instruction
Concept of Operations (CONOPS)
Incident Response Plan (IRP)
Configuration Management Plan (CMP)
System Authorization Access Request (SAAR)
Vulnerability Management Plan\
System Security Plans (SSP)
Plan of Actions and Milestones (POAMs)
Workforce Improvement Management – Managing the workforce improvement training Program, to include:\
Annual Cyber Awareness Challenge training per Dodd 8500.1
Managing agency compliance with the requirements of DoDD 8570.1 and DoD 8570-M for the IA Workforce Improvement Program (WIP)
Classification series - determining the occupational series and title for positions for DOD employees
Provide operational risk management support for CS-managed systems, whether networked or standalone.
The networks include varying security classifications, architectures, mobile devices, Virtual Private Networks (VPNs) and other remote access architectures and technologies, including Secure Socket Layer.
Provide CS’ portion of the Tier 3 Computer Network Defense (CND) services in accordance with DoDI O-8530.2, CJCSI 6510.01E, and CJCSM 6510.01.
Participate in the CS change management process including attending the weekly Enterprise Change Control Board (ECCB) meetings, reviewing Requests for Change (RFCs) distributed in email, and performing risk assessments on hardware and software.
Evaluate all newly deployed servers and applications in the “Test” and “Production” enclaves and verify that the asset entries have been created in the DoD DPMS and ensure vulnerabilities have been mitigated and STIGs have been applied.
Review applications by performing an automated and/or manual scan of the application code and report findings in the application code scan to the SA for developer or remediation.
Plan and execute compliance, Assessment and Authorization (A&A) activities in support of CIO’s role as AO for client and its subcomponents including the following tasks:
Perform system registration in eMASS on behalf of the system owner
Perform system registration in DITPR on behalf of the system owner
Update eMass with IA Controls on behalf of system owner
Update eMASS POA&M information when required on behalf of the system owner
Assist with development and maintain Operational Level Agreements (OLAs) and end-to- end Standard Operating Procedures (SOPs) to identify collaborative responsibilities and support process interaction with other Government and contractor IT groups.
Support enterprise level Information Assurance Vulnerability Management (IAVM) and DoD Reporting Management and Support including vulnerability management oversight activities for all assets in the “Test” and “Production” enclaves and all standalone systems.
Provide support the DoD Risk Management Framework (RMF) for all Information Systems (IS), enclaves, and application systems under the purview of the CIO per DoDI 8510.01
Other duties as assigned

Minimum Qualifications: (To perform this job successfully, an individual must be able to perform each essential duty satisfactorily.)

Bachelor's Degree in Computer Science, Cyber Security or a related field preferred
10+ years of demonstrated experience in Information Technology (IT)
5+ of those 10 years managing IT projects or programs focused on interpreting and applying DoD Cybersecurity (CS) policy and guidance to operational DoD IT environments.
Education may be used in lieu of experience
Experience in 8+ of the following areas of expertise:
Current Microsoft server and workstation OS security configurations
Current Red Hat Linux Enterprise OS security configurations
Current Unix OS security configurations
Current Microsoft server and desktop application security
VMWare security
Database security (e.g., Oracle, MS SQL, MS Access)
Border device security (e.g., firewall, VLANs, IP Subnetting, Ports and protocols)
Encryption standards
Vulnerability scanning using approved DoD scanner
Application code scanning with Fortify or other industry standard product
HBSS monitoring
Auditing (e.g., system accounts, security logs, system and network anomalies)
Working knowledge of DoD Components
Metrics – capture and documentation
Technical writing – technical documents and user training materials
Experience required includes analysis, design and implementation of security procedures of hardware and software on complex, large-scale systems in an enterprise environment.
Experience with current NIST Federal Information Processing Standards (FIPS) and Special Publications (SP): SP800-18, SP800-37, SP800-53, SP800-53A, SP800-60, FIPS-199, FIPS-201 and FIPS-140-2, DoDI 8510.01.and other DoD and IC policies and their application to enterprise IT security.
Experience in security testing and security management using tools like, NESSUS and HP Web Inspect.
Verifiable Certifications required within 6 months of hire to meet DoDD 8570.1/DoD 8570.01-M certification requirements for the IA Manager (IAM) Level II or DoDD 8570.1/DoD 8570.01-M certification requirements for IAT III.
Secret Clearance required

Knowledge, Skills and Abilities:

Knowledge with current NIST Federal Information Processing Standards (FIPS) and Special Publications (SP): SP800-18, SP800-37, SP800-53, SP800-53A, SP800-60, FIPS-199, FIPS-201 and FIPS-140-2, DoDI 8510.01.and other DoD and IC policies and their application to enterprise IT security.
Knowledge in security testing and security management using tools like, NESSUS and HP Web Inspect
Must have advanced working knowledge of a variety of computer software applications in word processing, spreadsheets, database (MSWord, Excel, Access, PowerPoint and Outlook)

Physical Demands: (The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.)

While performing the duties of this Job, the employee is regularly required to sit and talk or hear. The employee is frequently required to walk; use hands to finger, handle, or feel and reach with hands and arms. The employee is occasionally required to stand; climb or balance and stoop, kneel, crouch, or crawl. The employee must occasionally lift and/or move up to 25 pounds. Specific vision abilities required by this job include close vision.

Work Environment: (The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job.)

The employee will normally work in a temperature-controlled office environment, with frequent exposure to electronic office equipment.
During visits to areas of operations, may be exposed to extreme cold or hot weather conditions. Is occasionally exposed to fumes or airborne particles, toxic or caustic chemicals, and loud noise.

Ready to be seen?

Apply now to have the opportunity to be considered for similar jobs at leading companies in the Seen network for FREE.

Be seen in a new Security Analyst job

Skip the search

Zero stress and one profile that can connect you directly to 1000s of companies.

Best-fit jobs—for you

We’ll take it from there. After you tell us what you’re looking for, we’ll show you off to matches.

Free Career Coaching

Boost your interview skills, map your tech career and seal the deal with 1:1 career coaching.

You get tech. We get you.

Join now and be seen.