Senior Security Analyst

Job Family

Cyber Consulting

Up to 25%

Ability to Obtain Public Trust

• Review SC&A (Security Controls & Assessment) packages submitted by business and technical stewards to ensure completeness, accuracy, and alignment with security and compliance requirements.
• Submit and coordinate application security scans (e.g., vulnerability scans, SAST/DAST, dependency scans) with appropriate security teams or scanning tools.
• Analyze scan results, validating true positives vs. false positives and assessing risk severity and impact to the organization.
• Advise system owners and technical teams on remediation strategies, timelines, and best practices to address identified vulnerabilities.
• Track remediation progress and ensure findings are resolved in accordance with organizational security policies and SLAs.
• Provide security guidance throughout the system lifecycle to improve security posture and reduce recurring issues.

• Review SC&A (Security Controls & Assessment) packages submitted by business and technical stewards to ensure completeness, accuracy, and alignment with security and compliance requirements.
• Submit and coordinate application security scans (e.g., vulnerability scans, SAST/DAST, dependency scans) with appropriate security teams or scanning tools.
• Analyze scan results, validating true positives vs. false positives and assessing risk severity and impact to the organization.
• Advise system owners and technical teams on remediation strategies, timelines, and best practices to address identified vulnerabilities.
• Track remediation progress and ensure findings are resolved in accordance with organizational security policies and SLAs.
• Provide security guidance throughout the system lifecycle to improve security posture and reduce recurring issues.

• Must be able to OBTAIN and MAINTAIN a Federal or DoD "PUBLIC TRUST"; candidates must obtain approved adjudication of their PUBLIC TRUST prior to onboarding with Guidehouse. Candidates with an ACTIVE PUBLIC TRUST or SUITABILITY are preferred
• Minimum of FIVE (5) years of experience in Risk Management Framework / Security Assessment and Authorization.
• RMF Experience in developing complete ATO packages for systems; including SSP, FIPS 199, E-Authentication, PTA/PIA, Incident Response Plan, Contingency Plan, and Configuration Management Plan.
• Experience with conducting vulnerability scans and remediation findings.
• Experience with NIST 800-53 and NIST 800-37.
• Experience with cloud systems and SaaS products, and understanding of the FedRAMP requirements.
• Experience with security monitoring tools (e.g., Splunk, Tenable, Big Fix, Microsoft Purview, Symantec DLP, Sentinel, Cloud Watch, Security Center).
• Experience reporting to executives’ system risk analysis and findings. Capable of translating technical findings to meaningful and impactful risks.

• Experience as software developer – capable of building dashboards within suites like Microsoft Power BI and Power App. Capable of configuring APIs with security tools into dashboards (such as Tenable, Splunk, and GRC Platforms including CSAM).

Guidehouse offers a comprehensive, total rewards package that includes competitive compensation and a flexible benefits package that reflects our commitment to creating a diverse and supportive workplace.

• Medical, Rx, Dental & Vision Insurance
• Personal and Family Sick Time & Company Paid Holidays
• Position may be eligible for a discretionary variable incentive bonus
• Parental Leave and Adoption Assistance
• 401(k) Retirement Plan
• Basic Life & Supplemental Life
• Health Savings Account, Dental/Vision & Dependent Care Flexible Spending Accounts
• Short-Term & Long-Term Disability
• Student Loan Pay Down
• Tuition Reimbursement, Personal Development & Learning Opportunities
• Skills Development & Certifications
• Employee Referral Program
• Corporate Sponsored Events & Community Outreach
• Emergency Back-Up Childcare Program
• Mobility Stipend

Guidehouse is an Equal Opportunity Employer–Protected Veterans, Individuals with Disabilities or any other basis protected by law, ordinance, or…