Cybersecurity Risk Analyst

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Cybersecurity A&A Risk Analyst based in the United States.

• Manage the full lifecycle of Risk Management Framework (RMF) activities in accordance with NIST Special Publication 800-37.
• Develop, review, and maintain security authorization documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Review FedRAMP authorization packages and updates, monitor authorization packages in the FedRAMP Secure Repository, and support the assessment and use of cloud services.
• Evaluate and validate security control implementation under NIST SP 800-53 Revision 5.
• Conduct security risk assessments aligned with NIST SP 800-30 and provide actionable recommendations to Authorizing Officials and senior stakeholders.
• Support continuous monitoring and ongoing authorization by reviewing vulnerability scans, tracking POA&Ms, and coordinating remediation activities.
• Collaborate with system owners, Information System Security Officers (ISSOs), Cloud Service Providers, and other stakeholders.
• Analyze federal regulations, agency directives, cybersecurity policies, standards, procedures, and implementation guidance.
• Conduct gap analyses, recommend remediation strategies, and contribute to control overlays, security baselines, and control-tailoring guidance.
• Provide subject matter expertise during governance discussions and peer-review cybersecurity policies and documentation.
• Support enterprise risk reporting, compliance dashboards, and metrics using ServiceNow.
• Assist with oversight inquiries, corrective-action tracking, and other cybersecurity analysis and documentation activities.

• Bachelor’s degree in Cybersecurity, Information Technology, Public Policy, or a related discipline, or equivalent professional experience.
• At least seven years of progressive cybersecurity experience, including a minimum of four years supporting federal Risk Management Framework and Assessment and Authorization (A&A) activities.
• Demonstrated experience implementing the NIST Risk Management Framework and working with federal cybersecurity compliance requirements.
• Professional cybersecurity certification such as CISSP, CISM, or CAP.
• Familiarity with the Federal Information Security Modernization Act (FISMA), the Federal Zero Trust Strategy (OMB M-22-09), and federal cloud security requirements.
• Experience working with FedRAMP-authorized environments and supporting Moderate- and/or High-impact systems.
• Strong understanding of security control assessment, authorization documentation, risk analysis, continuous monitoring, and remediation processes.
• Proficiency with Microsoft 365 applications.
• An active Public Trust clearance or the ability to obtain one.
• Must be a U.S. citizen or legal permanent resident.
• Preferred experience with ServiceNow, CSAM, or comparable governance, risk, and compliance (GRC) tools.
• Familiarity with Atlassian Confluence and Jira.
• Familiarity with federal guidance on responsible AI use, including Executive Order 13960 and OMB M-25-21 and M-25-22.
• Experience supporting federal research or grant-management systems is an advantage.
• Ability to meet applicable pre-employment screening requirements.

• Annual salary: $110,000–$112,000, depending on qualifications, experience, and location.
• Retirement savings: 401(k) plan with a company match of up to 6%.
• Healthcare coverage: Medical, dental, and vision insurance, including prescription drug coverage.
• Paid time off: Paid leave and holidays.
• Insurance protection: Basic life and accidental death and dismemberment (AD&D) insurance, with supplemental life coverage options.
• Disability coverage: Short-term and long-term disability insurance.
• Well-being support: Employee Assistance Program (EAP).
• Healthcare savings options: Flexible Spending Account (FSA) and Health Savings Account (HSA).
• Professional growth: Training, development, and certification support.