Cybersecurity Analyst

SHR Consulting Group; Arlington (VA); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

401(k) Match

Paid Time Off

Federal Holidays

Certification Reimbursement

Training Support

Life Insurance

Disability Insurance

Job summary

SHR Consulting Group, LLC is a small business delivering enterprise IT, cybersecurity, and program management services to DoD and federal agencies. We seek experienced Cybersecurity Analysts to support RMF, vulnerability management, and risk assessments for a large DoD environment, with multiple Senior and Intermediate openings.

The role involves analyzing security-tool results, validating findings, coordinating patching, RMF evidence collection, and briefing leadership on risk and compliance

Qualifications

• Experience securing operating systems against DISA STIGs and configuring host firewalls.
• Experience with RMF/NIST controls documentation and validation.
• Active DoD security clearance or eligibility to obtain one is required.
• Onsite work in the National Capital Region is required.

Responsibilities

• Perform technical cybersecurity assessments of Windows, Linux, servers, networks, and applications.
• Analyze and validate findings from security tools and drive remediation.
• Maintain RMF evidence in eMASS and support authorization packages.
• Develop POAs&Ms for vulnerabilities and compliance deviations.
• Brief leadership on risk and compliance status and remediation progress.

Skills

Windows security

DISA STIGs

RMF

eMASS

HBSS/ESS

ACAS

Tanium

Patching (MECM)

PowerShell

Education

Bachelor's degree in CS / Engineering

Tools

ACAS

HBSS/ESS

Splunk

Tanium

Red Hat Satellite

MECM

Job description

SHR Consulting Group, LLC is a small business delivering enterprise IT, cybersecurity, and program management services to the Department of Defense and federal civilian agencies. We support mission-critical infrastructure at the Pentagon and across the National Capital Region, and we invest in our people through competitive compensation, professional certification support, and long-term career growth on stable, multi-year programs.

Position Summary

We are a rapidly growing organization seeking experiencedCybersecurity Analysts to support cyber compliance, technical security assessments, vulnerability management, cyber hardening, and Risk Management Framework (RMF) activities for a large enterprise Department of Defense environment. Multiple openings are available at Senior and Intermediate levels.

The successful candidate will analyze enterprise security-tool results, validate technical findings, drive remediation, maintain RMF evidence in eMASS, support cyber-readiness activities, and brief technical and Government leadership on risk and compliance status. eMASS is a government-owned application that supports integrated cybersecurity management, dashboard reporting, control-scorecard measurement, and authorization-package development.

Key Responsibilities

• Perform technical cybersecurity assessments of enterprise Windows, Red Hat Linux, workstation, server, application, network, and supporting infrastructure environments.
• Analyze and validate findings from ACAS, HBSS/ESS, Trellix, Axonius, Evaluate-STIG, Splunk, Tanium, SCAP, STIG Viewer, and other approved Enterprise Security Services (ESS) tools.
• Assess systems against DISA STIGs, IAVM notices, DoD cyber tasking, and approved security baselines; identify vulnerabilities, configuration deviations, missing patches, security-tool coverage gaps, and asset discrepancies.
• Coordinate with system administrators, engineers, system owners, and platform teams to implement and validate patches, Group Policy changes, certificate updates, endpoint-security changes, and secure-configuration remediations.
• Drive assigned systems toward compliance with DISA STIGs, IAVMs, applicable DoD orders, and organizational remediation timelines.
• Develop, maintain, and track Plans of Action and Milestones (POA&Ms) for unresolved vulnerabilities and compliance deviations, including technical details, risk impact, mitigation actions, responsible parties, milestones, and planned completion dates.
• Support RMF activities in accordance with DoDI 8510.01 and NIST guidance, including eMASS updates, control implementation statements, evidence collection, security-control validation, assessment artifacts, risk records, and authorization-package support.
• Validate security controls against NIST SP 800-53 requirements and document results in eMASS, SharePoint, or other approved repositories.
• Support CCORI, CORA, CSSP, and Cyber Hardening Mission activities through pre-assessment validation, checklist management, evidence preparation, corrective-action tracking, remediation coordination, and closure verification.
• Monitor approved DoD, DISA, JSP, and organizational channels for IAVMs, cyber orders, security directives, and other tasking; disseminate actions to responsible teams and track execution through closure.
• Provide DTO support by reviewing, analyzing, coordinating, tracking, and validating closure of DISA Task Orders, including required security configuration changes, firewall-rule updates, ports/protocols/services changes, vulnerability mitigations, technical documentation, validation testing, and completion evidence in accordance with established DoD, DISA, JSP, and program procedures.
• Maintain and validate required security-tool coverage across managed assets, ensuring ESS/HBSS, ACAS, Splunk, Tanium, and other required tools are installed, properly configured, communicating with management consoles, and tracked to resolution when reporting issues occur.
• Support patch and hot-fix deployment across multiple operating-system platforms using MECM, Group Policy, PowerShell, Tanium, Red Hat Satellite Server, YUM, or equivalent enterprise-management tools.
• Develop cyber-compliance metrics, remediation trackers, dashboards, and executive-ready reports for monthly program reviews and leadership briefings.
• Apply advanced Microsoft Excel skills—including formulas, pivot tables, XLOOKUP/VLOOKUP, conditional logic, data reconciliation, charts, and trend analysis to evaluate vulnerability trends, compliance posture, risk scores, overdue actions, and remediation performance.
• Brief technical teams, program management, and Government leadership on technical findings, enterprise risk, compliance trends, remediation status, and decisions required.
• Support Systems Security Reviews, independent control testing, audit preparation, inspection response, and continuous-monitoring activities.

Minimum Qualifications

• Demonstrated ability and experience in daily operations and maintenance of large, complex IT projects and IT staff similar in size and scope to this order
• Three (3) or more years of experience securing operating systems against DISA STIGs and configuring/maintaining host firewalls; experience hardening Windows Server and Red Hat Linux platforms required.
• Working knowledge of the DoD IAVM program, the DISA Vulnerability Management System (VMS), and the Continuous Monitoring Risk Scoring (CMRS) system.
• Knowledge of DoD vulnerability scanning standards and tools, defense-in-depth concepts, and incident response, auditing, and CNDSP practices.
• Hands-on experience with cyber tools, including HBSS/ESS, ACAS (Tenable), Splunk, and Tanium.
• Experience supporting RMF (NIST SP 800-37), NIST SP 800-53R control documentation and validation, and accreditation programs such as FISMA, OMB, DoD IG inspections, and ACA.
• Experience deploying patches and hot fixes against required deadlines using MECM, Group Policy, PowerShell, Red Hat Satellite/YUM, or Tanium.
• For the Senior variant: 5+ years of experience and ACAS administrator certification/experience are strongly preferred.
• Strong analytical, written, and verbal communication skills with the ability to brief technical risk to Government leadership.

Education

• Bachelor’s degree in Computer Engineering, Computer Information Systems, Telecommunications, Management Information Systems, Cybersecurity, or a related field; or equivalent combination of education and three (3)+ recent years of documented relevant experience.

Certification Requirements

• Must meet DoD 8570.01-M / DoD 8140 IAT Level II baseline certification requirements prior to start (e.g., Security+ CE, CCNA-Security, CySA+, GICSP, GSEC, or equivalent). Computing Environment certification appropriate to the role is also required.

Security Clearance

• Active Secret clearance required at minimum. U.S. citizenship required.
• 100% onsite at a government facility within the National Capital Region (NCR), primarily at the Pentagon, Crystal Gateway, Taylor Building, Mark Center, or other JSP-designated alternate site. Must be local to the DC Metro Area with reliable transportation.
• Competitive salary commensurate with experience and clearance level
• Comprehensive medical, dental, and vision coverage
• 401(k) with company contribution
• Paid time off and eleven federal holidays
• Certification reimbursement and training support (DoD 8140 baseline and computing environment certifications)
• Life and disability insurance

SHR Consulting Group, LLC is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status.