Information Assurance Analyst

Clearance Requirement: Active Secret
Employment Type: Full-Time

Disruptive Solutions, a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering mission-focused cybersecurity and technology solutions for federal and commercial clients. We specialize in advanced cybersecurity operations, AI/ML integration, cloud modernization, data governance, and risk management. With a proven track record supporting agencies like the Department of Defense (DoD), Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury, we deliver innovative solutions that maximize efficiency and strengthen cyber resilience.

At our core, we are dedicated partners committed to securing the mission with innovation, integrity, and measurable impact.

Disruptive Solutions is seeking an experienced Information Assurance (IA) Analyst to support cybersecurity, Risk Management Framework (RMF), and continuous monitoring activities for State. The IA Analyst will work closely with ISSOs, system owners, security engineers, SCAs, and other cybersecurity stakeholders to maintain system authorization documentation, collect and validate security control evidence, track vulnerabilities and remediation activities, and help ensure information systems remain compliant and audit-ready.

• Support ISSOs with implementation and ongoing execution of the NIST Risk Management Framework (RMF) for assigned information systems.
• Develop, maintain, and update authorization artifacts including System Security Plans (SSPs), security control implementation statements, POA&Ms, system inventories, Security Impact Analyses (SIAs), Contingency Plans (CPs), Incident Response Plans (IRPs), Configuration Management Plans (CMPs), and supporting security documentation.
• Build and maintain security control evidence packages, including evidence indexes, inherited control matrices, system boundary documentation, and network and data-flow diagrams.
• Collect and organize security evidence including configuration baselines, SOPs, access control lists, screenshots, system configurations, and log samples.
• Review continuous monitoring results and identify findings contributing to elevated system risk.
• Track vulnerability findings, remediation activities, and findings remaining open beyond established remediation timelines.
• Maintain POA&Ms entries within the applicable GRC platform and collect supporting evidence for finding closure and ISSO validation.
• Review vulnerability and compliance scan results and track critical and high-risk findings through remediation.
• Interpret security and compliance findings from technologies including Tenable/Nessus, Wiz, STIG Viewer, SCAP, and comparable security platforms.
• Support compliance with applicable CISA Binding Operational Directives (BODs) and vulnerability remediation requirements.
• Support Security Control Assessments (SCAs) by preparing assessment materials, collecting requested artifacts, and assisting with security control demonstrations.
• Support annual Contingency Plan testing and security control assessments, including preparation of test plans, coordination of participants, documentation of results, and tracking lessons learned.
• Register and maintain system records within applicable GRC and continuous monitoring platforms, including Arch Angel, iPost, or comparable technologies.
• Support system asset inventory and application grouping accuracy.
• Prepare cybersecurity meeting materials, document meeting minutes, and maintain action-item and remediation trackers.
• Assemble audit and data-call response packages containing SSPs, POA&Ms, vulnerability reports, assessment results, contingency plan test results, and supporting…