hybrid Security Analyst

Our client is a software company based in Herndon, VA that provides secure cloud enterprise software and data solutions for the US government, defense, and intelligence community. They are hiring for a hybrid Security Analyst (3 days on-site) to maintain cybersecurity and regulatory compliance within their cloud enterprise environments using FedRAMP. The technology stack includes Red Hat Linux, Windows Servers, containerization, and automation. This is an opportunity to build secure cloud environments for government and defense clients. You’ll work with advanced technologies, support critical compliance initiatives, and collaborate with teams. They’re looking for someone with experience in federal compliance, automation scripting, and vulnerability management in cloud environments., * Creating, updating, and maintaining FedRAMP-required security documentation and compliance artifacts

• Assisting with continuous compliance monitoring, including POA&M management and corrective actions
• Advising stakeholders on evolving government and cloud security policies and requirements
• Identifying, prioritizing, and remediating system vulnerabilities across cloud and enterprise environments
• Automating cybersecurity processes with scripting (Python, Bash, PowerShell, etc.)
• Collaborating with Cloud Operations and cybersecurity teams to ensure ongoing compliance and security maturity

• Deep understanding and documentation of information system specifications and security controls (logical/physical diagrams, data flow)
• Application of enterprise security frameworks, including FISMA and NIST SP 800, especially for cloud environments
• Knowledge of Risk-Based Vulnerability Framework and vulnerability prioritization/remediation
• Ability to create automation scripts to minimize manual workload (Python, Bash, Java, PowerShell)
• Experience analyzing container vulnerabilities and remediation paths (OS and App level)
• Familiarity with current FedRAMP, DoD, and NIST controls, including vulnerability management

Desired Skills & Experience

• Experience creating automation scripts (Python, Bash, Java, PowerShell)
• Knowledge of container scanning tools, CI/CD pipelines, AWS ECR, Container Image Mirroring
• Understanding attack vectors and vulnerability exploitability in complex environments
• Strong knowledge of Federal/DoD policies and risk methodologies: FedRAMP, NIST SPs, RMF overlays
• Hands-on experience with DISA STIGs and SRGs, CNSSI, NIST RMF
• Experience drafting/executing security documentation, ATO packages, POA&Ms, policies