Information Assurance Analyst

• Manage and maintain the security posture of enterprise cloud and network services throughout all phases of the Risk Management Framework (RMF) lifecycle.\n
• Conduct regular vulnerability scans of network and cloud assets using government-approved tools, analyze scan results, and coordinate with technical teams to prioritize remediation actions.\n
• Perform continuous monitoring and compliance validation of network devices, servers, and cloud resources against Security Technical Implementation Guides (STIGs) and other agency-specific benchmarks.\n
• Analyze and verify compliance within the enterprise cloud environment (e.g., AWS, Azure), ensuring alignment with FedRAMP controls and proper implementation of the shared responsibility model.\n
• Develop, update, and maintain all necessary RMF documentation, including the System Security Plan (SSP), security control traceability matrices, and Plans of Action and Milestones (POA&M).\n
• Serve as a primary point of contact for internal and external security audits, responsible for gathering and presenting evidence of control implementation to auditors.\n
• Track, interpret, and report on Information Assurance Vulnerability Management (IAVM) directives, coordinating with technical teams to ensure timely remediation and reporting.\n
• Provide information assurance expertise and guidance to network and cloud engineering teams to ensure security controls are integrated into the design and implementation of new services (“security by design”).\n

• Require BS degree with a minimum of 5 years of dedicated experience in Information Assurance or Cybersecurity.\n
• At least 2 years of experience of securing cloud environments (e.g., AWS, Azure) and a working knowledge of FedRAMP controls.\n
• Must hold a certification meeting DoD 8570/8140 IAM Level II requirements (e.g., CompTIA CASP+, CISM, or CISSP).\n

n \nRequired Skills:\n \n \n

• Direct hands on application of the Risk Management Framework (RMF) from initiation to continuous monitoring.\n
• Experience conducting vulnerability assessments using tools such as ACAS, Nessus, or equivalent systems.\n
• Experience implementing and auditing systems against Security Technical Implementation Guides (STIGs).\n