Cyber Security Analyst

MANTECH is seeking a Cyber Security Analyst II to support our operations in Virginia Beach, VA. This is an on‑site position.

Become an integral part of a diverse team while working at an Industry Leading Organization, where our employees come first. At Man Tech, you’ll help protect our national security while working on innovative projects that offer opportunities for advancement.

• Prepare for Risk Management Framework (RMF) execution and perform system categorization by conducting comprehensive mission analysis, defining the authorization boundary with detailed network diagrams, hardware/software inventories, and data flow documentation. Determine mission criticality and apply relevant overlays (e.g., Privacy, Space, Cross-Domain) to establish the appropriate security control baseline per National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 and Department of Defense (DoD)/Navy policy.
• Select, tailor, and document security controls throughout the system lifecycle. Lead control selection and tailoring workshops with stakeholders, justify deviations via risk-based rationale, and document all decisions in Enterprise Mission Assurance Support Service (eMASS). Develop and maintain the System Security Plan (SSP), cybersecurity policies, procedures, plans (e.g., Contingency Plan, Incident Response Plan), and strategies that align with organizational risk tolerance and mission objectives.
  
  Ensure cybersecurity architecture supports availability, integrity, confidentiality, authentication, and non-repudiation.
• Implement and test security controls using authoritative sources including Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), Assured Compliance Assessment Solution (ACAS)/Nessus vulnerability scans, and NIST SP 800-53A Revision 5 Assessment Procedures (APs). Execute full-scope testing across all assets impacting Confidentiality/Integrity/Availability (C/I/A), validate configurations, patch levels, access controls, and document implementation status and test results with precision in eMASS.
  
  Upload compelling evidence (e.g., scan reports, configuration files, screenshots) to support compliance assertions and enable traceability.
• Assess the effectiveness of security control and Assessment Procedure (AP) implementation by verifying each AP is fully satisfied across the entire authorization boundary. Conduct independent testing, examine artifacts, and interview personnel to confirm operational reality matches documented claims. Determine compliance status (Compliant, Non-Compliant, Not Applicable), identify root causes of deficiencies, and document detailed findings in eMASS. Ensure all non-compliant controls are traced to Plan of Actions & Milestones (POA&M) entries with complete risk analysis.
• Support system authorization by maintaining a complete and accurate RMF accreditation package in eMASS, including the SSP, Security Authorization Package (SAP), engineering documentation, and network drawings. Manage POA&M entries with granular risk assessments (Raw Severity, Mitigations, Predisposing Conditions, Relevance of Threat, Likelihood, Impact, Residual Risk) and coordinate formal workflow actions. Prepare for and support Security Assessment Report (SAR) development and Authorizing Official (AO) decision-making.
• Conduct continuous monitoring by implementing and executing the System Level Continuous Monitoring (SLCM) Strategy. Track control compliance through automated and manual methods, perform monthly vulnerability scans, apply STIG updates, and conduct Annual Security Reviews (ASRs). Communicate significant findings upstream…