Cybersecurity Analyst / ISSO

Spry Methods, Inc.; Stafford (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Spry Methods, Inc. seeks a cybersecurity leader to align AI/ML risk with DoD directives and enterprise risk posture.

You will oversee RMF A&A activities, POA&M remediation, and STIG compliance across Windows, Linux, and network devices, delivering secure, mission-ready environments. Responsibilities include evaluating architectures through zero-trust, interpreting CTOs and other directives, and drafting policies with continuous monitoring strategies.

Qualifications

• Experience assessing the risk of AI/ML capabilities within DoD guidelines.
• Ability to interpret CTOs, Task Orders, and DoD directives for cyber programs.
• Expert-level POA&M creation and management across enterprise systems.
• Advanced understanding of CND architectures and zero-trust in design.
• Leadership in RMF A&A lifecycles using eMASS and related workflows.
• Knowledge of NIST SP 800-53, CNSSI 1253, NIST SP 800-161/162, DoDI 8510.01.
• Experience drafting cybersecurity policies, IRPs, and continuous monitoring.
• Proficiency with DISA STIG Viewer, SCC, and validation of STIG/SRG on OSes.

Responsibilities

• Lead cybersecurity risk management across enterprise systems.
• Assess AI/ML capabilities and ensure compliance with DoD directives.
• Oversee RMF A&A activities and POA&M remediation strategies.
• Develop cybersecurity policies and continuous monitoring strategies.
• Provide technical leadership to maintain secure, mission-ready environments.
• Validate security controls and STIG compliance across platforms.

Skills

AI/ML risk assessment

DoD directives interpretation

POA&M management

CND with zero-trust

RMF leadership

NIST SP 800-53 / CNSSI 1253 / SP 800-X

Policy drafting & IR plans

DISA STIG / SCC tools

Tools

DISA STIG Viewer

SCAP Compliance Checker (SCC)

eMASSter

Job description

Who We're Looking For (Position Overview):

This role requires a strategic understanding of how emerging technologies (like A.I.) and high-level USMC Cyber Directives impact the acquisition lifecycle and overall enterprise risk posture.

What Your Day-To-Day Looks Like (Position Responsibilities):

Leading cybersecurity risk management efforts across enterprise systems by assessing AI and machine learning capabilities, overseeing RMF authorization activities, managing POA&M remediation strategies, and ensuring compliance with DoD cybersecurity directives and NIST standards. Responsibilities include evaluating system architectures through a zero-trust lens, interpreting and implementing Cyber Tasking Orders, validating security controls and STIG compliance, developing cybersecurity policies and continuous monitoring strategies, and providing technical leadership to maintain secure, mission-ready environments.

What You Need to Succeed (Minimum Requirements):

• A.I. Risk & Architecture: Experience assessing the risk of Artificial Intelligence (A.I.) and Machine Learning (ML) capabilities, including familiarity with emerging DoD A.I. security guidelines, data pipeline security, and assessing A.I. toolsets within the authorization boundary
• DoD/ DoW Cyber Directives: Proven capability to interpret, analyze, and direct programmatic responses to MFCC (Marine Forces Cyber Command) and DCDC (Department of Defense Cyber Defense Command) TaskOrds, Cyber Tasking Orders (CTOs), and other organizational directives, policies, and messages governing cyber / IT
• Strategic POA&M Management: Expert-level creation, management, and strategic burn-down of complex Plan of Action and Milestones (POA&Ms) across multiple enterprise systems, ensuring alignment with USMC continuous monitoring timelines / requirements
• CND Oversight: Advanced understanding of Computer Network Defense (CND) architectures, including zero-trust principles, network boundary defense, and threat intelligence integration
• RMF Leadership: Deep expertise navigating eMASS and leading systems through the complete Risk Management Framework (RMF) Assess and Authorize (A&A) lifecycles and workflows
• Deep understanding of NIST SP 800-53 security controls, CNSSI 1253, NIST SP 800-161 & NIST SP 800-162, and DoDI 8510.01
• Experience drafting organizational cybersecurity policies, Incident Response Plans, and Continuous Monitoring Strategies
• Advanced proficiency using the DISA STIG Viewer, executing SCAP Compliance Checker (SCC), using eMASSter, and manually validating STIG/SRG requirements on diverse operating systems (Windows, Red Hat Linux, Cisco IOS, Cisco ASA)
• Expert level understanding of applying zero-trust methodologies to system design and tracking implementation throughout the system life-cycle

Ideally, You Also Have (Preferred Qualifications):

• Experience Level: 4-8 years of progressive experience in DoD cybersecurity, information assurance, or Computer Network Defense (CND)
• Security Clearance: Active Secret clearance
• DoD 8140/8570.01-M Baseline Certification: IAM Level II or III (e.g., CISSP, CISM, CAP/CGRC) AND highly recommended to hold a CSSP Auditor/Manager baseline

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.