ATO Security Analyst

Ironarch Technology LLC; United States; On-site; USD 80,000 - 100,000; Full time

Benefits offered by this job

Competitive compensation

Medical, dental and vision benefits

401(k) retirement plan with company match

20 days of PTO

11 paid holidays

Sabbatical programs

Company-paid disability and life insurance

Job summary

Ironarch Technology LLC is seeking an ATO Security Analyst to support the Department of Veterans Affairs in maintaining cybersecurity compliance across research environments. This critical role involves managing ATO and ATC packages, ensuring systems remain authorized and operational to provide Veterans access to modernized care tools.

The ideal candidate will have hands-on experience with the RMF lifecycle and must be a U.S. citizen capable of obtaining a VA Public Trust. The position offers a remote work option with competitive benefits.

Qualifications

• 5 years of relevant experience, or 13 years without a degree.
• Capacity to manage multiple open items across systems and deadlines.
• Must be U.S. citizen and able to obtain a VA Public Trust.

Responsibilities

• Develop and maintain ATO and ATC packages, including security plans.
• Support all RMF steps from security categorization to authorization.
• Conduct security assessments and lead client meetings on ATO topics.

Skills

Hands-on experience with RMF lifecycle

Ability to create and maintain SSPs

Working knowledge of NIST SP 800-53

Clear communication skills

Education

Bachelor's degree in computer science or related field

Tools

ServiceNow CAM application

Job description

About the Role

IronArch Technology is looking for an ATO Security Analyst to support the Department of Veterans Affairs in maintaining cybersecurity compliance across VA research environments. This is a documentation-first role. You will own the paperwork that keeps VA systems authorized and running: ATO and ATC packages, security artifacts, POA&Ms, gap analyses, and FISMA documentation.

You'll work directly with VA Information System Owners (ISOs), Information System Security Officers (ISSOs), site managers, and research stakeholders to drive ATO activities from start to finish.

What You’ll Do

Develop, review, and maintain ATO and ATC packages, including system security plans (SSPs), control implementation statements, FISMA documents, and POA&Ms across a portfolio of VA research systems. Own the tracking and resolution of open POA&M items, keep authorization schedules current, and ensure nothing falls through the cracks.

Support all RMF steps from security categorization through authorization, coordinating directly with VA ISOs, ISSOs, site managers, and system owners to close gaps and hit deadlines. Provide cybersecurity compliance answers to research teams using current VA Handbooks, Directives, and NIST guidance.

Conduct security assessment reviews for VA research submissions, work within the VA’s Continuous Authorization and Monitoring (CAM) framework, and support product installation planning for major system changes. Lead client-facing meetings on ATO topics regularly, walking both technical and non-technical audiences through complex authorization status.

Requirements

Education and Experience

Bachelor's degree in computer science, electronics engineering, or another engineering or technical discipline, plus 5 years of relevant experience. 13 years of relevant experience may substitute in lieu of a degree (8 additional years may substitute for education per contract requirements).

What we’re looking for

Hands‑on experience with the full RMF lifecycle, categorization through authorization, and the ability to create and maintain SSPs, control implementation statements, POA&Ms, and FISMA security documentation independently. Working knowledge of NIST SP 800‑53 is a hard requirement. Ability to read authorization documentation, identify gaps, build plans to address them, and communicate clearly to non‑security audiences.

Capacity to manage multiple open items simultaneously across systems, deadlines, and expiration windows while keeping everything current and accurate. Experience supporting secure product installation planning and working with stakeholders through the ATO process is essential.

Must be able to obtain and maintain a VA Public Trust or Suitability/Fitness determination. U.S. citizenship required.

AI Capabilities

Comfortable using AI tools to assist with documentation drafting, artifact review, and compliance gap analysis. Understanding that AI accelerates RMF documentation work, but accuracy and human review are non‑negotiable in an authorization context.

Preferred Experience

• Experience with ServiceNow’s Continuous Authorization and Monitoring (CAM) application and familiarity with VHA Research and Development Policies, VA Handbook 1200, VA 6500 Handbooks and Directives.
• Experience supporting ATOs for specialized or connected devices.
• An active Public Trust clearance (not required to apply but will accelerate onboarding if possessed).

Remote, U.S.-based. Occasional travel may be required to support program needs.

Impact / What Success Looks Like

In the first 90 days, establish working relationships with VA ISOs and ISSOs, get current on open ATO packages, and take ownership of POA&M tracking. By six months, the systems you support will have no overdue authorization milestones, and you will be the first point of contact for compliance questions. In the long run, your work ensures VA research systems remain authorized and operational, directly enabling Veterans to access care through modernized VA tools.

Why IronArch Technology?

• Awarded Best Place to Work 9 times
• Competitive compensation and market‑leading bonus opportunities
• Medical, dental and vision benefits with significant subsidized premium and Health Reimbursement Account for eligible medical expenses
• Company‑provided healthcare concierge assistance to explain coverage, find quality care, and address billing concerns
• 401(k) retirement plan with dollar‑for‑dollar company match up to 3% and 50 cents on the dollar for the 4th and 5th percent immediately
• 20 days of PTO accumulated per calendar year
• 11 paid holidays
• Bereavement, jury duty, parental (maternity/paternity/adoption), and military leaves
• Sabbatical programs
• Company‑paid short‑ and long‑term disability and life insurance
• Voluntary life, accidental and indemnity income replacement benefits
• Matching donation program and annual philanthropic activities
• And more!

IronArch Technology is an equal‑opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law.

In alignment with applicable state and local pay transparency laws, IronArch includes a salary range in our job descriptions to support equity and transparency in our hiring process. The compensation range provided reflects what we reasonably expect to offer for this role, with the final offer determined by a variety of factors including skills, experience, and scope of responsibilities.