Cyber Risk & Exposure Analyst II — DoD RMF & Vulnerability

Invictus International; Alexandria (VA); On-site; USD 90,000 - 120,000; Full time

Job summary

Invictus International seeks a Cybersecurity Risk & Exposure Analyst II in Alexandria, VA to support SOC investigations and continuous-monitoring activities. The role requires TS/SCI clearance with CI polygraph eligibility, and focuses on vulnerability analysis, asset correlation, and RMF/security control implementation.

The candidate will coordinate with ISSOs/owners and remediation teams, analyze recurring exposures, and maintain documentation for risk decisions and investigative evidence.

Qualifications

• Bachelor's degree or equivalent experience; four additional years may substitute for a degree.
• Minimum four years of relevant experience beyond education.
• Strong written and verbal communication to document technical work clearly.
• Knowledge of vulnerability management, DoD RMF and security controls.
• Experience with ACAS/Tenable, runZero, STIG/SCAP or similar tools preferred.
• Must hold DoD 8570 IAT II or IAM II certification and DoD/IC environment experience.

Responsibilities

• Independently perform vulnerability/exposure analysis and monitoring supporting investigations.
• Correlate asset data, configuration, and telemetry to assess weaknesses' impact.
• Provide context to operations and analysts during investigations and remediation.
• Coordinate findings with system owners and remediation teams and RMF follow-up.
• Analyze recurring vulnerabilities to identify remediation priorities.
• Develop repeatable checklists and metrics for exposure analysis and coordination.
• Maintain records of findings, risk decisions, and supporting evidence.
• Communicate operational risk in terms understandable to technical and compliance stakeholders.

Skills

Vulnerability management

RMF/security controls

DoD compliance

Operational risk communication

Education

Bachelor's degree in a technical discipline

4 years relevant experience in lieu of degree

Tools

ACAS/Tenable

runZero

STIG/SCAP

Job description

Invictus International seeks a Cybersecurity Risk & Exposure Analyst II in Alexandria, VA to support SOC investigations and continuous-monitoring activities. The role requires TS/SCI clearance with CI polygraph eligibility, and focuses on vulnerability analysis, asset correlation, and RMF/security control implementation.

The candidate will coordinate with ISSOs/owners and remediation teams, analyze recurring exposures, and maintain documentation for risk decisions and investigative evidence.