Cybersecurity Analyst

Who We're Looking For (Position Overview):Spry Methods is Looking for a Cybersecurity Analyst to support the Department of Transportation's Cybersecurity Program services.  The Analyst will be a member of a small team that manages a variety of activities associated with the National Institute of Science and Technology (NIST) Risk Management Framework (RMF) Special Publications. More specifically, this position will provide Continuous Monitoring validation support and assist in maintaining security assessment deliverables for several systems using the Department's Governance Risk Compliance (GRC) tool.

What Your Day-To-Day Looks Like (Position Responsibilities):

• Develop functional and technical requirements; serve as a POC for Information Systems with security issues;
• Prepare and update reports to ensure that the unit complies with mandated internal and external security reporting requirements, including Federal Information Security Modernization Act (FISMA) and Capital Planning;
• Adhere to system security controls that ensure the protection of Sensitive but Unclassified (SBU) information using authentication techniques, encryption, firewalls, and access controls;
• Assist with Security Assessments;
• Attend meetings and draft meeting minutes;
• Review and analyze reports from different scanning tools;
• Review and update Plan of Action and Milestones (POA&M) with remediation status reports;
• Update CSAM; 
• Validate correct implementation of POAMs; 
• Update CSAM with inventory information;
• Serve as an advisor in risk assessments of all systems and mitigate vulnerabilities;
• Adhere to Continuous Monitoring practices to ensure that security controls are maintained over the life of IT systems
• Assist the System Owner in the development, testing and maintenance of contingency plans, backup and storage procedures;
• Audit and monitor application, system and security logs for security threats, vulnerabilities and suspicious activities; report suspicious activities to the agency Incident coordinator;
• Coordinate security program and system elements with the agency IT Program Managers by evaluating system environments for security requirements and controls including: IT Security Architecture, hardware, software, telecommunications, security trends, and associated threats and vulnerabilities;
• Validate patch management and scanning techniques for all unit systems;
• Support and facilitate the security awareness, training, and education program; and
• Assist the Information System Security Manager (ISSM), or CISO in any other security related duties, as required.

What You Need to Succeed (Minimum Requirements):

• Public Trust
• 3-5 years direct experience supporting federal organizations Cybersecurity programs.
• Experience drafting FISMA related artifacts to include: system security plans, incident response plans, configuration management plan, FIPS 199, digital identity risk assessments, security impact analysis, contingency plan,  security assessment plans and reports, Plan of Action and Milestones (POA&M), and training materials. 
• Experience in applying NIST Special Publications to information systems.
• Experience with performing  and validating information system continuous monitoring of security controls to ensure that they continue to be implemented correctly, operating as intended and producing the desired outcome with respect for meeting the security requirements. 
• Knowledge of cybersecurity tools such as: Tenable, Qualys, Governance Risk Compliance (GRC) tools (e.g. Xacta, CSAM, etc.,). 
• Experience participating in security assessments and/or audits. 

Ideally, You Also Have (Preferred Qualifications):

• Certified Information Systems Security Professional (CISSP) certification.
• Certificate of Cloud Security Knowledge (CCSK)
• Certified Privacy and Data Protection Expert (CIPP)
• Certified Governance Risk Compliance (CGRC) 
• 8+ years experience supporting federal organizations Cybersecurity programs.
• Experience with conducting security assessments, audits, and control implementation in accordance with NIST Special Publications.
• DoD 8570 IAM Level 2.

#CJ