Cyber Sec Analyst II

• auditing of system security security controls, stig configurations, and acas scans
• supporting the cyber test process for system accreditation and risk management framework (rmf) processes
• executing continuous monitoring of systems to include vulnerability analysis, iavm reporting, and validation of security controls in support of ato requirements
  • the information gathered during these activities will be used to create and maintain associated poa&m(s) and to track the systems security posture
• performing assess and authorize (a&a) duties within risk management framework (rmf) with knowledge of department of navy risk management framework process guide, nist special publications, enterprise mission assurance support service (emass)
• conducting cyber security (cs) analysis, mitigation, remediation, and monitoring to ensure compliance with applicable dod and department of the navy (don) policies, procedures, and regulations
• working within vram to perform daily/weekly activities to include but are not limited to exord, frago, and cto concurrence and acceptance
• reviewing of site scan uploads and verification of asset compliancy
• compiling and analysis of vram data and reporting findings to team lead

#li-ks1

• detail-oriented and analytical cyber tester with strong knowledge of windows os (active directory, group policy objects, powershell), linux/unix os (rhel configuration, ssh, privilege escalation, file permissions), and virtualization (vmware vsphere/esxi)
• execute, monitor, and analyze automated vulnerability and compliance scans utilizing acas (assured compliance assessment solution) / tenable nessus
• perform rigorous security technical implementation guide (stig) checks and run security content automation protocol (scap) tools to evaluate operating systems, network devices, and applications against federal/defense standards
• utilize stig viewer (v2 and v3) to create, import, edit, and consolidate .ckl and .cklb compliance checklist files for system artifacts
• utilize emasster (and related scripting frameworks) to ingest, process, parse, and aggregate vulnerability scan data, stig checklists, and acas .nessus outputs
• diagnose and resolve complex issues related to scanning failures, credentialed scan errors, network access blocks, and tool misconfigurations across diverse environments
• review scan outputs, filter out false positives, assess risk levels, and generate comprehensive compliance reports for stakeholders and rmf (risk management framework) packages
• this position requires a highlevel of customer management and communication
• minimum security+ ce certification

• vram (vulnerability remediation asset manager) familiarity:
  • export compliant scan results (.nessus or certified xml formats) from acas security center/tenable.sc to vram
  • format, validate, and upload vulnerability scan data into vram, ensuring proper mapping of assets
  • monitor and analyze vph (vulnerability priority health) numbers, tracking metrics for relevant assets (ra), non-relevant assets (nra), and open vulnerabilities
  • identify negative performance trends, high-risk delta spikes, and stale data to brief leadership on the command's current vulnerability posture
  • process and track iavms (information assurance vulnerability management) and fcb (field change bulletin) notices
• experience being a navy qualified validator
• os certification (linux+, rhel, microsoft, cisco ccent/ccna)

src is a contractor for the u.s. Government, this position will require u.s. Citizenship as well as, a u.s. Government security clearance at the top secret level with top secret / sci eligibility

• up to 15% travel

scientific research corporation is an advanced information technology and engineering…