Sr Cyber Security Analyst

#li-ll1

• integrating cybersecurity requirements and security controls into the software development lifecycle, from requirements definition through deployment and sustainment
• reviewing system, application, interface, and architecture designs for cybersecurity risks and compliance with applicable government requirements
• supporting implementation and maintenance of secure devsecops practices, including automated security testing and continuous monitoring
• conducting or supporting security assessments, control validation, risk analysis, and remediation tracking for software applications and supporting infrastructure
• analyzing vulnerability scan results, application security findings, code-scanning results, and configuration-compliance data; validate findings and coordinate mitigation actions
• performing risk management framework (rmf) activities, including preparation and maintenance of security documentation, assessment artifacts, risk registers, and plans of action and milestones (poa&ms)
• evaluating security impacts of software releases, configuration changes, third-party components, and architecture modifications
• collaborating with developers to implement secure coding practices and remediate security defects
• supporting security incident analysis, root-cause analysis, corrective-action development, and after-action reporting
• developing technical reports, executive summaries, risk briefings, security recommendations, and status updates for program and government stakeholders
• providing technical mentorship and quality review for junior cybersecurity analysts
• participating in agile ceremonies, technical interchange meetings, architecture reviews, release-readiness reviews, and cybersecurity working groups

• active ts/sci clearance with the ability to maintain eligibility throughout employment
• active cissp certification in good standing
• bachelor’s degree in cybersecurity, computer science, information systems, software engineering, engineering, or a related technical field
• eight or more years of progressive experience in cybersecurity, information assurance, application security, systems security engineering, or a related technical discipline
• three or more years of experience supporting cybersecurity activities on software development, software modernization, systems integration, or devsecops programs
• demonstrated experience applying cybersecurity principles within the sdlc, including requirements analysis, design review, development, testing, deployment, and sustainment
• experience with security-control assessment, risk analysis, vulnerability management, and remediation tracking
• working knowledge of nist cybersecurity guidance and risk-management practices, including:
  • nist risk management framework (rmf)
  • nist special publication 800-53 security and privacy controls
  • nist special publication 800-37 risk-management guidance
  • nist special publication 800-218 secure software development framework (ssdf)
• experience reviewing or analyzing findings from vulnerability-scanning, configuration-compliance, web application security, static application security testing (sast), dynamic application security testing (dast), software composition analysis (sca), or similar tools
• familiarity with secure coding concepts, common application vulnerabilities, and remediation approaches, including owasp risks
• experience producing cybersecurity documentation, such as security assessment reports, system security plans, risk registers, poa&ms, vulnerability-management reports, and briefing materials
• experience obtaining system authorization, performing continuous monitoring, obtaining authority to operate (ato) packages, and performing control-assessment activities
• ability to communicate cybersecurity risks and…