Cybersecurity Analyst

The Cybersecurity Analyst serves as the senior cybersecurity lead responsible for managing and executing all cybersecurity compliance, Risk Management Framework (RMF), and Authority to Operate (ATO) activities for the program. This individual acts as the primary liaison between the project team and the Government cybersecurity team, including the Information System Security Officer (ISSO), ensuring compliance with Department of Defense (DoD) cybersecurity requirements.

The Cybersecurity Analyst leads the end-to-end ATO process, develops and maintains all required RMF documentation, manages security assessments and vulnerability remediation efforts, and directs Security Technical Implementation Guide (STIG) implementation activities. The successful candidate will ensure cybersecurity requirements are fully integrated throughout the system lifecycle and support accreditation efforts in DoD cloud and on-premises environments.

Key Responsibilities

• Lead and manage the complete DoD Authority to Operate (ATO) process.
• Serve as the primary cybersecurity liaison between project stakeholders, Government cybersecurity officials, and the ISSO.
• Develop, maintain, and manage all RMF artifacts and documentation, including:
• System Security Plan (SSP)
• Plan of Action & Milestones (POA&M)
• Security Assessment Reports (SAR)
• Security Control Traceability Matrices and supporting documentation
• Direct implementation and maintenance of DoD RMF controls and security requirements.
• Lead vulnerability management activities, including:
• Security scanning
• Risk analysis
• Remediation planning
• Continuous monitoring activities
• Manage and oversee STIG implementation and compliance activities.
• Coordinate cybersecurity assessments, audits, and authorization reviews.
• Ensure compliance with DoD cybersecurity policies, FedRAMP requirements, and DoD Cloud Computing Security Requirements Guide (SRG) standards.
• Support accreditation activities for Impact Level (IL) 4 and IL5 cloud environments.
• Provide cybersecurity subject matter expertise to program leadership and technical teams.
• Monitor cybersecurity risks and recommend mitigation strategies to maintain system authorization status.

• Bachelor’s degree in Cybersecurity, Information Assurance, Computer Science, Information Technology, or a related technical field.
• Minimum of eight (8) years of continuous Cybersecurity or Information Assurance experience.
• Minimum of five (5) years of hands-on experience managing the DoD Risk Management Framework (RMF) process for a major information system.
• Demonstrated success leading at least one information system through a complete Authority to Operate (ATO) process on a DoD network.
• Experience with FedRAMP and DoD Cloud Computing Security Requirements Guide (SRG) requirements for IL4 and IL5 environments.
• Strong knowledge of:
• DoD cybersecurity policies and procedures
• RMF implementation and continuous monitoring
• Vulnerability management
• Security control assessments
• STIG compliance and remediation

Nice to Have Qualifications:

• DoD 8570.01-M IAM Level II certification, such as:
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CASP+ (CompTIA Advanced Security Practitioner)
• Experience supporting federal or DoD cloud-based systems.
• Excellent communication and stakeholder management skills.
• Experience coordinating with Authorizing Officials (AOs), ISSOs, Security Control Assessors (SCAs), and cybersecurity teams.

The compensation range for this position is $153,000-187,000. Compensation decisions depend on a wide range of factors, including but not limited to location, skill sets, experience and training, security clearances, licensure and certifications, and other business and organizational needs.

BDR Solutions, LLC, (BDR) supports the U.S. Federal Government in successfully achieving its mission and goals. Our service and solution delivery starts with understanding each client’s end-state, and then seamlessly integrating within each Agency’s organization to improve and enhance business and technical operations and deployments.