> Markdown version of [/jobs/ext/1256513-system-security-analyst](https://www.wearedevelopers.com/jobs/ext/1256513-system-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # System Security Analyst - **Company:** Strategic Inc - **Location:** Arlington, VA, United States (Remote available) - **Experience:** Experienced - **Salary:** $100,000.0 - $145,000.0 - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, Cloud Computing, Cyber Security, Information Technology, Tools for Reporting, Plan of Action and Milestones, Vulnerability Analysis - **Published:** July 13, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=5644b10315a07113 ## About the Role * Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field (equivalent experience considered). * Must have a relevant certifications (e.g., Security+, CISSP, CAP, or similar) - candidates with certifications will be given priority. * 3+ years of relevant security analysis experience (senior candidates with more experience encouraged to apply). * Demonstrated experience conducting security assessments of production systems and applications. * Working knowledge of security control frameworks and control families (e.g., NIST SP 800-53 or equivalent). * Experience managing and remediating POA&Ms and security findings, including inherited/legacy findings. * Ability to develop mitigation and remediation plans, including task sequencing and scheduling. * Experience conducting formal control assessments/testing to validate control implementation. * Experience with continuous monitoring processes and sustaining system authorization. * Experience reviewing third-party/vendor risk artifacts (e.g., SOC reports, penetration test results). * Strong written communication skills for documenting security requirements and findings. * Experience advising both security and engineering/developer teams on remediation approaches. * Must be a US Citizen and able to obtain a Public Trust Clearance PREFERRED EXPERIENCE/QUALIFICATIONS * Familiarity with Risk Management Framework (RMF) processes. * Experience with vulnerability scanning and reporting tools. * Familiarity applying security controls to Cloud applications. ## Description The essential functions include, but are not limited to the following: * Analyze current production systems and applications to identify security vulnerabilities and risks. * Document security requirements for production systems and applications. * Identify and recommend the security controls and control families necessary to secure production environments. * Define and document system security boundaries in coordination with system owners and technical teams. * Inherit, review, and manage current Plans of Action and Milestones (POA&Ms) and prior security findings. * Develop mitigation and implementation strategies to remediate identified vulnerabilities and findings. * Build planning schedules and task timelines to drive POA&Ms toward closure. * Track and report POA&M status and remediation progress to stakeholders. * Conduct control assessments and control testing (e.g., NIST SP 800-53A) to validate control implementation and support audit readiness. * Perform continuous monitoring activities to sustain system authorization and ongoing control effectiveness. * Support audit readiness activities, including review of vendor SOC reports and third-party penetration test results. * Test and maintain contingency plans (ISCP/DRP/IRP) to support system resiliency. * Integrate automated security scanning into CI/CD pipelines and review findings with development teams. * Provide advisory support to program-level security teams and development teams on security best practices and compliance requirements. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Green Cloud Computing](https://www.wearedevelopers.com/videos/592-green-cloud-computing) - [Minimising the Carbon Footprint of Workloads](https://www.wearedevelopers.com/videos/1198-minimising-the-carbon-footprint-of-workloads) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)