Information Assurance Analyst DoS CSS

We are an employee-centric company that truly values our team members and the contributions they make to our customers and the missions they support. We pride ourselves on being forward-leaning thinkers and on building teams that are, and continue to be, technically proficient across a broad range of cyber mission areas. One Zero full-time employees receive a highly competitive benefits package, including health, dental, vision, and life insurance, a 401(k) with company matching, paid time off and holidays, an employee referral program, and educational assistance.

Additional details are available on our website:

Position Title: Information Assurance Analyst

Location: Remote; must reside within the National Capital Region (NCR).

Work Schedule: Full-time, 40 hours per week. Must be available during Department core hours of 9:00 a.m. – 3:00 p.m. ET, Monday – Friday, and flex working hours as needed to meet CST day-to-day and emergent requirements. No work is performed on Federal holidays or during Government closures.

Employment Type: Full-Time, Exempt (W-2), contingent upon Call Order award

Clearance: Secret

The Information Assurance Analyst supports SME and Senior Information Security Analysts in operating the Risk Management Framework and continuous monitoring program for DT/EA/CST consular systems. The Analyst develops and maintains authorization artifacts and evidence, runs the weekly and monthly continuous monitoring cadence, supports assessments and contingency plan tests, and captures the meeting minutes and data-call responses that keep systems audit-ready. Analysts who demonstrate proficiency may be assigned as ISSO of record for lower-complexity systems.

• Develop and update RMF artifacts under the direction of the assigned ISSO: SSP sections and Security Control Implementation Statements, POA&M entries, system inventories, network and data-flow diagrams, SIAs, and CP/IRP/CMP updates.
• Build and maintain the Evidence Index, Inherited Controls Matrix, and System Boundary & Data Flow Package for assigned systems; collect configuration baselines, SOPs, ACLs, screenshots, and log samples as control evidence (RMF Steps 1–3).
• Review iPost scores weekly for assigned systems, identify findings driving elevated risk, and track remediation status; maintain the list of findings open more than 30 days.
• Update POA&M entries in the GRC tool at least monthly and within 5 business days of status changes; gather and attach closure evidence for ISSO validation.
• Review vulnerability and compliance scan results within 5 business days of scan completion; track critical and high findings to BOD timelines; document remediation in POA&M(s).
• Support annual Contingency Plan tests and Annual Control Assessments: draft test plans, coordinate participants, record results and lessons learned.
• Prepare Security Control Review Meeting materials and collect artifacts requested by the Security Control Assessor; assist with control demonstrations (RMF Step
  4).
• Capture and distribute meeting minutes for system meetings; maintain action-item logs.
• Assemble Audit and Data Call Response Packages (SSP, POA&Ms, vulnerability reports, assessment results, CP test reports) and respond to HVA, BOD, OMB, OIG, and CDM data calls within DT/EA/CST timelines.
• Register and maintain system records in the GRC tool; support asset inventory and iPost application grouping accuracy.
• Collect data for quarterly FISMA metrics and weekly Issue Resolution, Remediation Status, and Risk Acceptance Recommendation reports.

• Three (3)+ years of information assurance or cybersecurity compliance experience with hands-on exposure to NIST RMF / FISMA authorization activities.
• Working knowledge of NIST SP…