Cybersecurity Risk & Exposure Analyst

Invictus International; Colorado Springs (CO); On-site; USD 90,000 - 130,000; Full time

Job summary

Invictus International seeks a Cybersecurity Risk & Exposure Analyst with TS/SCI clearance to support DoD/IC security operations. You will analyze vulnerabilities, treat exposures, and coordinate remediation with system owners and ISSOs/ISSMs to strengthen risk posture.

The role requires DoD 8570 IAT II/IAM II readiness, strong written communication, and experience with ACAS/Tenable and asset discovery tools. A bachelor’s degree and related cybersecurity experience are essential.

Qualifications

• Bachelor's degree in a technical discipline; additional 4 years may substitute for degree.
• Minimum two years of cybersecurity experience beyond education.
• Strong written and verbal communication skills; ability to document technical work clearly.
• Knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF and security controls.
• Experience with ACAS/Tenable, runZero or similar asset-discovery/exposure tools; STIG/SCAP; POA&M processes.

Responsibilities

• Support operational cyber risk, vulnerability/exposure, and continuous-monitoring activities for SOC watch operations and stakeholders.
• Review vulnerability data, asset info, STIGs, and documentation to identify weaknesses and asset context.
• Assist in enriching SOC investigations with asset and vulnerability information and documented controls.
• Coordinate findings with SOC personnel, ISSOs/ISSMs, system owners and remediation teams; maintain records of findings and actions.
• Track vulnerabilities, remediation actions, and POA&M items; collect continuous-monitoring evidence.
• Contribute to exposure, vulnerability, and monitoring metrics and reporting for risk reduction.
• Apply networking, OS, vulnerability, security controls, and RMF concepts to connect findings with security context.
• Analyze vulnerabilities to determine risk, exploitation scenarios, affected assets, and operational impact.
• Support metrics, customer reporting, and A&A activities as required.

Skills

Vulnerability management

Asset exposure analysis

RMF security controls

Technical risk assessment

Written and verbal communication

Education

Bachelor's degree in a technical discipline

Tools

ACAS/Tenable

runZero

STIG/SCAP

POA&M processes

Job description

Title: Cybersecurity Risk & Exposure Analyst

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

• Support operational cyber risk, vulnerability/exposure, and continuous-monitoring activities that provide security context to SOC watch operations and affected system stakeholders
• Review ACAS/Tenable vulnerability data, runZero asset information, STIG/configuration findings, system documentation, and other approved sources to help identify known weaknesses and relevant asset context
• Assist in enriching SOC investigations with available information about affected assets, known vulnerabilities, security configuration, system ownership, and documented controls
• Support coordination of SOC-derived security findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation personnel; maintain clear records of findings, actions, and status
• Assist with tracking vulnerabilities, remediation actions, POA&M-related items, and continuous-monitoring evidence when SOC findings identify or validate a system security weakness
• Contribute to recurring exposure, vulnerability, and continuous-monitoring metrics and reporting used to support operational awareness and risk reduction
• Apply foundational knowledge of networking, operating systems, vulnerabilities, security controls, and RMF concepts to connect technical findings with system security context
• Analyze identified vulnerabilities and configuration weaknesses to determine technical risk, potential exploitation scenarios, affected assets, and mission/operational impact
• Support continuous-monitoring metrics, customer/service reporting, and assessment and authorization activities as required

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum two (2) years of relevant cybersecurity experience in addition to education
• Strong written and verbal communication skills and the ability to document technical work clearly
• Demonstrated knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF/security controls, and technical risk assessment appropriate to the position level
• Experience with ACAS/Tenable, runZero or comparable asset-discovery/exposure tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, security-control evidence, or comparable technologies and processes is desired
• Ability to coordinate technical findings, risk context, remediation status, and supporting evidence with SOC personnel, system ISSOs/ISSMs, system owners, engineers, and other stakeholders
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment desired
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled

Helping all candidates find great careers is our goal. The information you provide here is secure and confidential.