Cybersecurity Risk & Exposure Analyst II

Invictus International; Colorado Springs (CO); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Equal Opportunity Employer/Veteran/Dis

Job summary

Invictus International in Colorado Springs is seeking a Cybersecurity Risk & Exposure Analyst II to perform vulnerability analysis and support SOC investigations and RMF processes.

The role requires TS/SCI clearance with CI polygraph, strong communication skills, and hands-on experience with ACAS/Tenable, runZero, and DoD security controls. Coordinate with system owners and remediation teams to reduce mission risk.

Qualifications

• Bachelor's degree from an accredited institution in a technical discipline; an additional 4 years may be substituted in lieu of a degree.
• Minimum four (4) years of relevant experience in addition to education level.
• Strong written and verbal communication skills and the ability to document technical work clearly.
• Demonstrated knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF/security controls, and technical risk assessment.
• Experience with ACAS/Tenable, runZero or comparable asset-discovery/exposure tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, security-control evidence, or comparable technologies.
• Must possess current DoD 8570 IAT II or IAM II certification.
• Experience working in a DoD or IC environment.
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph.

Responsibilities

• Independently perform operational vulnerability/exposure analysis and continuous-monitoring activities supporting SOC investigations, cyber risk prioritization, and system security coordination.
• Correlate ACAS/Tenable findings, runZero asset context, STIG/configuration information, system criticality, network/security telemetry, and other data to assess weaknesses and impact.
• Provide vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts during investigations and proactive analysis; identify weaknesses contributing to exploitation or mission risk.
• Coordinate SOC-derived findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams to validate affected assets, clarify risk, and determine required monitoring or RMF follow-up.
• Analyze recurring vulnerabilities, configuration weaknesses, and exposure patterns to identify remediation priorities and systemic conditions needing escalation.
• Develop and maintain repeatable checklists, procedures, and metrics for operational exposure analysis, remediation validation, SOC-to-ISSO coordination, and continuous-monitoring support.
• Maintain accurate records of findings, remediation status, risk decisions, tickets/actions, and supporting evidence in approved systems.
• Apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk in operational terms.

Skills

Vulnerability management

RMF/security controls

DoD 8570 IAT II/IAM II

Asset/exposure analysis

Education

Bachelor's degree in a technical discipline

Tools

ACAS/Tenable

runZero

STIG/SCAP tools

Job description

Cybersecurity Risk & Exposure Analyst II

Title: Cybersecurity Risk & Exposure Analyst II

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

• Independently perform operational vulnerability/exposure analysis and continuous-monitoring activities supporting SOC investigations, cyber risk prioritization, and system security coordination
• Correlate ACAS/Tenable findings, runZero asset context, STIG/configuration information, system criticality, network/security telemetry, and other available data to assess the relevance and potential impact of identified weaknesses
• Provide vulnerability, asset, configuration, and control context to Cybersecurity Operations and Threat Analysts during investigations and proactive analysis; identify known weaknesses that may contribute to exploitation or increase mission risk
• Coordinate SOC-derived findings with system ISSOs/ISSMs, system owners, administrators, engineers, and remediation teams to validate affected assets, clarify risk, support mitigation, and determine required continuous-monitoring or RMF follow-up
• Analyze recurring vulnerabilities, configuration weaknesses, and exposure patterns to identify remediation priorities and systemic conditions requiring escalation or broader corrective action
• Develop and maintain repeatable checklists, procedures, and metrics for operational exposure analysis, remediation validation, SOC-to-ISSO coordination, and continuous-monitoring support
• Maintain accurate records of findings, remediation status, risk decisions, tickets/actions, and supporting evidence in approved systems
• Apply knowledge of network security, common protocols, system architecture, vulnerabilities, security controls, and DoD requirements to communicate technical risk in operational terms

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum four (4) years of relevant experience in addition to education level
• Strong written and verbal communication skills and the ability to document technical work clearly
• Demonstrated knowledge of vulnerability management, asset and exposure analysis, DoD continuous monitoring, RMF/security controls, and technical risk assessment appropriate to the position level
• Experience with ACAS/Tenable, runZero or comparable asset-discovery/exposure tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, security-control evidence, or comparable technologies and processes is desired
• Ability to correlate vulnerability, asset, configuration, and system-security information and communicate operational risk to technical and compliance stakeholdersMust possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled