Security Assessment and Continuous Monitoring Analyst

Empower, Innovate, Impact! At Team A-TEK, we EMPOWER people to drive INNOVATION that IMPACTS mission!

A-TEK operates at the intersection of mission and innovation by applying our deep domain expertise across the federal markets. Embracing our digital-first strategy, A-TEK provides enhanced capabilities in application development, digital transformation, enterprise IT, and scientific services. Our solutions are designed to modernize, automate, secure, protect, and enhance the operations of our federal clients, ensuring they stay ahead in a rapidly evolving digital landscape.

Our work is fueled by a passion to serve our clients’ needs and to protect the safety and welfare of Americans. That passion shapes how we nurture our most valuable asset – Our Employees. A-TEK actively cultivates the talent that drives our success and fosters a creative, challenging, and mission-driven work environment for current and future employees.

The Security Assessment and Continuous Monitoring Analyst supports annual security assessments, continuous monitoring, POA&M management, cybersecurity documentation, vulnerability and risk tracking, GRC platform updates, and authorization sustainment for an HHS-affiliated agency. This individual collects and validates evidence, maintains accurate records, tracks findings, and keeps authorization packages ready for Government and independent assessor review.
Must be able to support hybrid work requirements in the Washington, DC metropolitan area or Research Triangle area.

• Support security control assessments for three primary authorization boundaries.
• Collect, organize, validate, and maintain assessment evidence and control implementation documentation.
• Coordinate assessment schedules, interviews, demonstrations, evidence requests, and assessor communications.
• Track findings from identification through remediation, validation, closure, or POA&M acceptance.
• Update POA&M status in the designated GRC platform within five business days of a status change.
• Perform continuous monitoring activities and maintain supporting documentation and evidence.
• Reconcile GRC records against system inventories, authorization artifacts, and operational information.
• Support the annual review cycle for system documentation and authorization artifacts.
• Monitor vulnerabilities, configuration changes, control status, and risk indicators.
• Support security impact analyses within 10 business days after identification of a change request.
• Prepare risk reports within 10 business days after assessments, major changes, or other triggering events.
• Support cloud and FedRAMP artifact reviews, control inheritance analysis, and continuous monitoring.
• Assist with system onboarding, decommissioning, data calls, audits, and cybersecurity reporting.
• Apply quality checks that promote accurate documentation and 98 percent GRC data accuracy.

• Demonstrated experience supporting Federal RMF, A&A, security assessments, and continuous monitoring.
• Knowledge of NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, FISMA, and POA&M requirements.
• Experience collecting and evaluating security control evidence.
• Experience maintaining SSPs, SARs, POA&Ms, risk records, and related cybersecurity artifacts.
• Understanding of vulnerability management, configuration management, and security impact analysis.
• Strong analytical, documentation, and stakeholder communication skills.
• Ability to manage concurrent priorities and meet time sensitive assessment and reporting deadlines.
• Ability to support hybrid work requirements in the Washington, DC metropolitan area or Research Triangle area.
• Education and experience that satisfy the proposed GSA labor category.

• Experience supporting HHS or another Federal health agency.
• Experience using JCAM or a comparable Federal GRC platform.
• Experience with cloud and FedRAMP artifacts, control inheritance, and shared responsibility models.
• Experience supporting independent assessors and addressing assessment findings.
• Experience in maintaining accurate system inventory and authorization data.
• CAP/CGRC, Security+, CISSP, CISM, or an applicable…