> Markdown version of [/jobs/ext/1368815-conmon-cyber-security-analyst](https://www.wearedevelopers.com/jobs/ext/1368815-conmon-cyber-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # CONMON Cyber Security Analyst - **Company:** Helios HR - **Location:** McLean, VA, United States - **Contract:** Permanent contract - **Skills:** Xacta, CompTIA Security+, Cyber Security, Information Systems, Federal Information Processing Standards (FIPS), Network Security, Microsoft Security Essentials, Cyber Threat Analysis, Patch Management, Splunk, Plan of Action and Milestones - **Published:** July 21, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9044166/conmon-cyber-security-analyst ## About the Role Sound knowledge of RMF, NIST 800-series, FIPS, SA&A processes, continuous monitoring, POA&M policies, and vulnerability/patch management. Experience using Cyber Risk Management Platforms (e.g., XACTA) for workflow automation, compliance tracking, and RMF execution. Strong interpersonal and communication skills to engage stakeholders and explain technical issues in a clear, mission-focused way. Hands-on experience interpreting vulnerability and compliance reports from XACTA, STIGs, ACAS, Prisma, Splunk, Trellix (HBSS), or similar tools. Solid analytical and problem-solving skills to identify root causes and recommend practical remediation steps. Some experience leading or contributing to security initiatives that require coordination across multiple teams. Ability to collaborate effectively in mixed technical environments and contribute to improving the overall security maturity of supported programs. Required Qualifications: Certifications: Obtain an IAT-III or Maintain IAT Level II Certification in compliance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management. CompTIA Cybersecurity Analyst (SySA+) CompTIA Security EC-Council Certified Network Defense CND v3 CCNA Security Global Industrial Cyber Security Professional (GICSP) GIAC Security Essentials (GSEC) Systems Security Certified Practitioner (SSCP) Education: Possess a Bachelor's degree 12 years' experience in addition to education. Clearance: Hold a Top Secret Security Clearance with SCI eligibility. Ability to Pass CI Poly. ## Description Responsible for supporting the security and maintenance of information systems throughout the RMF lifecycle; from preparation through decommission in alignment with ICD, DIA, and DoD/DoW cybersecurity policies. This role focuses on executing RMF tasks while actively engaging with DIA ISSMs/SCAs, and client PMs/ISSOs teams to ensure security activities lead to meaningful outcomes. This includes: Ensuring ISSOs remain focused on risk-reduction priorities, not just administrative tasks. Helping stakeholders understand why certain vulnerabilities matter and how remediation improves the system's overall security posture. Providing technical input and continuous monitoring support that contributes to measurable improvements in compliance and audit readiness. The analyst evaluates cybersecurity impacts of system changes, supports control implementation, and helps maintain accurate, actionable security documentation. Document vulnerabilities, misconfigurations, and issues clearly and thoroughly to support remediation planning and stakeholder understanding. Use XACTA to manage risk assessments, security control evidence, POA&M tracking, and compliance status. Monitor and track POA&M items, ensuring vulnerabilities identified in scans or audits are documented, mitigated, and closed appropriately with a focus on reducing repeat findings. Collaborate with ISSMs, ISSOs, SCAs, PMs, and other partners by providing guidance, clarifications, and context that help them make informed decisions. Represent cybersecurity standards and expectations in all engagements, reinforcing mission alignment and transparency. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [Maturity assessment for technicians or how I learned to love OWASP SAMM](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)