Cyber Sec Analyst II

Scientific Research Corporation; North Charleston (SC); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

401(k) match

Life insurance

Paid time off

Tuition reimbursement

Job summary

Scientific Research Corporation in North Charleston, SC, is seeking a Cyber Tester to audit system security controls, STIG configurations, and ACAS scans. You will support RMF/ATO processes and perform continuous monitoring, vulnerability analysis, and RMF package readiness.

The role requires experience with Windows and Linux environments, ACAS/Nessus, STIGs, and eMASS, plus DoD/Navy RMF knowledge. Strong communication with stakeholders is essential, including customer management

Qualifications

• Strong knowledge of Windows OS and AD, Group Policy Objects, PowerShell
• Knowledge of Linux/RHEL, SSH, privilege escalation, file permissions
• Experience with automated vulnerability and compliance scans (ACAS/Nessus)
• Ability to perform STIG checks and use SCAP tools
• Experience with STIG Viewer for compliance artifacts
• Familiarity with eMASS ingestion and analytics
• Diagnose and resolve scanning failures and credentialed scan issues
• Excellent customer management and communication
• Minimum Security+ CE certification
• Navy Qualified Validator experience preferred

Responsibilities

• Auditing of system security controls, STIG configurations, and ACAS scans
• Supporting the Cyber Test process for RMF and ATO processes
• Executing continuous monitoring and vulnerability analysis to support RMF
• Creating and maintaining POA&Ms and tracking security posture
• Performing A&A duties within RMF per DoD guidance
• Conducting CS analysis, mitigation, remediation, and monitoring to ensure DoD/DON compliance
• Working with VRAM to perform daily/weekly activities including EXORD/FRAGO CTO concurrence
• Reviewing site scan uploads and asset compliance
• Compiling and analyzing VRAM data and reporting findings to Team Lead

Skills

Windows OS

PowerShell

Linux/Unix

Vulnerability analysis

RMF processes

Stakeholder communication

Customer management

Education

Security+ CE

Navy Qualified Validator

Tools

ACAS

Nessus

STIG Viewer

eMASS

SCAP tools

VRAM

Job description

Description

• Auditing of system security security controls, STIG configurations, and ACAS scans


• Supporting the Cyber Test process for system accreditation and Risk Management Framework (RMF) processes


• Executing continuous monitoring of systems to include vulnerability analysis, IAVM reporting, and validation of security controls in support of ATO requirements
  
  
  
  • The information gathered during these activities will be used to create and maintain associated POA&M(s) and to track the systems security posture
  
  
  
  


• Performing Assess and Authorize (A&A) duties within Risk Management Framework (RMF) with knowledge of Department of Navy Risk Management Framework Process Guide, NIST Special Publications, Enterprise Mission Assurance Support Service (eMASS)


• Conducting Cyber Security (CS) analysis, mitigation, remediation, and monitoring to ensure compliance with applicable DoD and Department of the Navy (DON) policies, procedures, and regulations


• Working within VRAM to perform daily/weekly activities to include but are not limited to EXORD, FRAGO, and CTO concurrence and acceptance


• Reviewing of site scan uploads and verification of asset compliancy


• Compiling and analysis of VRAM data and reporting findings to Team Lead

#LI-KS1

Requirements

• Detail-oriented and analytical Cyber Tester with strong knowledge of Windows OS (Active Directory, Group Policy Objects, PowerShell), Linux/Unix OS (RHEL configuration, SSH, privilege escalation, file permissions), and Virtualization (VMware vSphere/ESXi)


• Execute, monitor, and analyze automated vulnerability and compliance scans utilizing ACAS (Assured Compliance Assessment Solution) / Tenable Nessus


• Perform rigorous Security Technical Implementation Guide (STIG) checks and run Security Content Automation Protocol (SCAP) tools to evaluate operating systems, network devices, and applications against federal/defense standards


• Utilize STIG Viewer (v2 and v3) to create, import, edit, and consolidate .ckl and .cklb compliance checklist files for system artifacts


• Utilize eMASSter (and related scripting frameworks) to ingest, process, parse, and aggregate vulnerability scan data, STIG checklists, and ACAS .nessus outputs


• Diagnose and resolve complex issues related to scanning failures, credentialed scan errors, network access blocks, and tool misconfigurations across diverse environments


• Review scan outputs, filter out false positives, assess risk levels, and generate comprehensive compliance reports for stakeholders and RMF (Risk Management Framework) packages


• This position requires a highlevel of customer management and communication


• Minimum Security+ CE certification

Desired Skills

• VRAM (Vulnerability Remediation Asset Manager) Familiarity:
  
  
  
  • Export compliant scan results (.nessus or certified XML formats) from ACAS SecurityCenter/Tenable.sc to VRAM
  
  
  • Format, validate, and upload vulnerability scan data into VRAM, ensuring proper mapping of assets
  
  
  • Monitor and analyze VPH (Vulnerability Priority Health) numbers, tracking metrics for Relevant Assets (RA), Non-Relevant Assets (NRA), and open vulnerabilities
  
  
  • Identify negative performance trends, high-risk delta spikes, and stale data to brief leadership on the command's current vulnerability posture
  
  
  • Process and track IAVMs (Information Assurance Vulnerability Management) and FCB (Field Change Bulletin) notices
  
  
  
  


• Experience being a Navy Qualified Validator


• OS certification (Linux+, RHEL, Microsoft, Cisco CCENT/CCNA)

Clearance Information

SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE TOP SECRET LEVEL WITH TOP SECRET / SCI ELIGIBILITY

Travel Requirements

• Up to 15% travel

About Us

Scientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.

SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.

EEO

Scientific Research Corporation is an equal opportunity employer that does not discriminate in employment.

All qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other protected characteristic under federal, state or local law.

Scientific Research Corporation endeavors to make www.scires.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact [e-mail] for assistance. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.