Cybersecurity Analyst

TIAG; Bethesda (MD); On-site; USD 80,000 - 90,000; Full time

Job summary

TIAG is hiring a Cyber Security Analyst to support USUHS in Bethesda, MD. The role focuses on modernizing RMF ATO packages and transitioning from NIST SP 800-53 Rev 3 to Rev 5 and IL-4.

You will drive the RMF lifecycle, prepare SSP/SAR/POA&M, draft tailored control narratives, and map evidence in ServiceNow GRC and eMASS. Requires active DoD Secret clearance and strong validation skills.

Qualifications

• Active DoD Secret clearance required.
• Strong technical validation skills to ensure control narratives align with actual system realities.

Responsibilities

• Support the RMF lifecycle and ATO modernization from gap analysis to package validation.
• Create and modernize RMF authorization packages, including SSP, SAR, POA&M, and Continuous Monitoring Plan.
• Draft and refine control narratives to reflect actual configurations rather than generic baselines.
• Develop, document, and manage POA&M for control gaps requiring remediation.
• Prepare all artifacts for eMASS readiness and Government upload.
• Map artifacts and POA&M to Control Objectives in ServiceNow GRC.

Skills

Active DoD Secret clearance

Job description

Job Details: Job Location: Bethesda, MD 20814, Position Type: Full Time, Salary Range: $80,000.00 - $90,000.00 Salary/year, Travel Percentage: None, TIAG is hiring Cyber Security Analyst to support our team at the Uniform Services University of Health Sciences (USUHS) in Bethesda, MD. The Cyber Analyst will support the modernization of the Authorization to Operate (ATO) packages for enterprise platforms, specifically targeting Google Cloud, Google Workspace, and ServiceNow GCC-High instances.

This role focuses on transitioning system environments from legacy NIST SP 800-53 Revision 3 documentation and existing DISA eMASS baselines to completely modernized, organizationally tailored NIST SP 800-53 Revision 5 and DoD Impact Level 4 (IL-4) authorization packages.

Key Responsibilities

• Provide comprehensive support across the full RMF lifecycle, driving the ATO modernization process from initial gap analysis through final package validation and closeout recommendations.
• Create and modernize complete RMF authorization packages, which must include the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and Continuous Monitoring Plan.
• Draft and refine implementation-specific control narratives (answering controls) to ensure they accurately reflect the system's actual configuration, directly replacing generic baseline statements.
• Develop, document, and manage POA&M for any control gaps identified during technical discovery that require future remediation.
• Prepare all required fields, supporting documentation, artifacts, and attachments to support eMASS readiness and Government upload.
• Upload and map artifacts, technical evidence, control responsibilities, and POA&M information to individual Control Objectives within the ServiceNow GRC Policy and Compliance module.
• Evaluate Cloud Service Provider FedRAMP packages to determine control inheritance, tailoring the baseline to reflect local Agency implementation, shared responsibilities, and DoD IL-4 requirements.
• Perform 100% Human-in-the-Loop (HitL) validation on all AI-assisted technical content to ensure narratives accurately address Rev 5 controls and contain no unsupported technical statements.
• Document organizational tuning decisions in coordination with system stakeholders, capturing risk acceptances, organizational overrides, compensatory mitigations, and tool-specific authorizations.

Qualifications: Required Experience:

• Active DoD Secret clearance required.
• Strong technical validation skills to ensure control narratives align with actual system realities rather than generic baseline statements.

TIAG is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a), and 41 CFR 60-741.5(a) and employment decisions shall be based solely on merit and without regard disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations. TIAG takes proactive steps to employ and advance in employment qualified individuals without regard to disability or protected veteran status. The parties also agree that, as applicable, they will abide by the requirements and may be subject and required to take action pursuant to the following laws and accompanying regulations:

• The Vietnam Era Veterans Readjustment Assistance Act of 1974, as amended (and its implementing regulations at 41 C.F.R. 60-300);
• Section 503 of the Rehabilitation Act of 1973, as amended (and its implementing regulations at 41 C.F.R 60-741); and
• Executive Order 13496 (and its implementing regulations at 29 C.F.R. part 471, Appendix A to Subpart A).