Cyber Security Consultant

Cyber Security Consultant with strong expertise in Governance, Risk and Compliance (GRC), NIST Risk Management Framework (RMF), Security Assessment and Authorization (SA&A), and Authorization to Operate (ATO) activities within U.S. federal, state, and local government environments. The consultant will assess security posture, conduct security and risk assessments, identify compliance gaps, develop and assess security controls, and support remediation and authorization activities aligned with FISMA, NIST SP 800-53, NIST SP 800-37, NIST SP 800-171, FedRAMP, CMMC, and applicable government security and privacy requirements. These frameworks are commonly used across federal agencies, federal systems, cloud services, and government contractors. The role will support creating ATO packages artefacts including - System Security Plans (SSP), Security Procedures, Security design artefacts, security risk assessments, Plans of Action and Milestones (POA&M. The consultant will collaborate with system owners, ISSOs, ISSMs, security architects, cloud and infrastructure teams, auditors/assessors, and government stakeholders to ensure security requirements are effectively implemented and maintained throughout the system lifecycle., Minimum 11 years of cybersecurity experience, with demonstrated experience supporting U.S. federal, state, local government, or regulated public-sector environments. Strong experience with NIST RMF, FISMA, Security Assessment and Authorization, ATO processes, NIST SP 800-53, NIST SP 800-171, IRS1075, CJIS, CMS MARS-E, HIPAA/HITECH, FedRAMP, security risk assessments, GRC, cloud security, Zero Trust, vulnerability management, security operations, and incident management. NIST describes RMF as encompassing preparation, categorization, control selection, implementation, assessment, authorization, and continuous monitoring.

• NIST RMF & ATO: Experience supporting RMF lifecycle activities, security authorization, control assessment, authorization packages, and continuous monitoring.
• FISMA & Federal Compliance: Strong understanding of FISMA and associated NIST standards applicable to federal information systems.
• Security Control Implementation & Assessments: Experience implementing, assessing technical, operational, and management controls related to NIST 800-53, IRS1075, FISMA/FEDRAMP and documenting control effectiveness and deficiencies.
• Security Documentation: Experience developing SSPs, SAPs, SARs, POA&Ms, risk assessments, control implementation documents, and authorization artifacts.
• Cloud Security: Experience assessing security configurations and controls across Microsoft Azure, AWS, or other government cloud environments.
• Zero Trust: Experience applying Zero Trust principles across identity, endpoint, network, application, workload, and data security.
• Identity & Access Management (IAM): Experience with Architecture and implementation of IAM solutions, access governance.
• Security Operations: Experience with SIEM/SOAR SOC operations, security monitoring, threat detection, endpoint security, and operational security controls.
• Incident Management: Experience supporting incident triage, investigation, containment, remediation, recovery, reporting, and lessons learned.
• Vulnerability Management: Experience evaluating vulnerabilities, prioritizing risk, coordinating remediation, and maintaining vulnerability and POA&M tracking.
• Continuous Monitoring: Experience supporting ongoing security control monitoring, vulnerability assessment, configuration compliance, and risk reporting.
• Security Architecture: Ability to evaluate cloud, infrastructure, network, application, identity, and data architectures against government security requirements.
• Privacy & Data Protection: Experience supporting privacy assessments and security controls for sensitive government information, PII, and regulated data.
• Stakeholder Management: Ability to collaborate effectively with government stakeholders, System Owners, ISSOs, ISSMs, Authorizing Officials, assessors, auditors, and technical delivery teams.
• Candidate must possess atleast 1 of the certifications - CISSP, CISM, CISA, CRISC, CCSP, GIAC,
• Microsoft Azure Security, or equivalent industry certifications are highly desirable.

Educational Requirements:

A Bachelor’s degree or foreign equivalent is required from an accredited institution. Will consider three years of progressive, relevant work experience instead of every year of education. Candidates who have completed a Master’s degree program are strongly preferred.

The job entails sitting and working at a computer for extended periods. Should be able to communicate by telephone, email, or face-to-face. Travel may be required as per the job requirements.

Infosys Public Services is seeking a Cyber Security Analyst to join our team.