Information System Security Compliance Analyst; Levels

Position Overview

We are seeking a detail-oriented cybersecurity compliance professional to support system authorization and continuous monitoring activities within a Federal environment. This role is responsible for managing the security authorization lifecycle for one or more information systems, ensuring compliance with Federal cybersecurity requirements, and maintaining the documentation necessary to support Authorization to Operate (ATO) decisions.

The ideal candidate will have experience working with NIST RMF, NIST SP 800-53 controls, security authorization packages, POA&M management, and compliance documentation. Candidates should be comfortable working with technical teams to assess control implementation, identify compliance gaps, and provide guidance to support remediation efforts and POA&M closure.

• Manage the security authorization lifecycle for one or more information systems in accordance with Federal Risk Management Framework (RMF) requirements.
• Coordinate activities required to obtain and maintain Authorization to Operate (ATO) approvals.
• Assess and track implementation of NIST SP 800-53 security controls and associated compliance requirements.
• Develop, review, update, and maintain authorization package documentation, including:
• System Security Plans (SSPs)
• Security Assessment Reports (SARs)
• Plan of Action and Milestones (POA&Ms)
• Risk Assessments
• Continuous Monitoring documentation
• Security-related policies and procedures
• Manage POA&M activities by tracking findings, monitoring remediation progress, validating corrective actions, and supporting closure efforts.
• Provide technical guidance and compliance recommendations to system owners, engineers, administrators, and security stakeholders to facilitate POA&M remediation and closure.
• Coordinate with technical teams to gather evidence supporting security control implementation and compliance requirements.
• Review vulnerability scan results, assessment findings, and security documentation to identify compliance gaps and areas requiring remediation.
• Support continuous monitoring activities by tracking security posture, compliance status, and ongoing control effectiveness.
• Participate in security assessments, audits, and compliance reviews conducted by internal and external stakeholders.
• Assist in the development of risk mitigation strategies and recommendations for addressing identified security weaknesses.
• Track authorization milestones, compliance deadlines, and remediation activities to ensure timely completion.
• Communicate compliance status, risks, findings, and recommendations to both technical and non-technical stakeholders.
• Support audits and reporting activities related to Federal cybersecurity requirements and organizational security programs.

• Experience supporting cybersecurity compliance, security authorization, risk management, or information security programs.
• Experience working with the NIST Risk Management Framework (RMF).
• Subject matter expertise with NIST SP 800-53 security controls and Federal cybersecurity compliance requirements.
• Experience supporting the development, maintenance, or review of authorization package documentation, including SSPs, SARs, POA&Ms, and Risk Assessments.
• Understanding of the Authorization to Operate (ATO) process and continuous monitoring requirements.
• Experience tracking and managing POA&M findings through remediation and closure.
• Ability to review technical security information and translate findings into compliance documentation and actionable recommendations.
• Understanding of cybersecurity principles, security controls, vulnerability management, and risk management concepts.
• Strong organizational skills with the ability to manage multiple systems, priorities, and compliance activities simultaneously.
• Strong written and verbal communication skills, including the ability to develop and review formal security documentation.
• Proficiency with Microsoft Office applications, particularly Excel, Word, and PowerPoint.
• U.S. Citizen or Green Card Permanent Resident with a minimum of three (3) years of U.S. residency.
• Ability to obtain and maintain an FAA Public Trust.