Cybersecurity Risk & Exposure Analyst III

Invictus International Consulting, LLC; Alexandria (VA); On-site; USD 140,000 - 190,000; Full time

Job summary

Invictus International Consulting, LLC is seeking a Senior Cybersecurity Risk & Exposure Analyst III to lead complex cyber risk analyses for DoD systems, correlate findings across asset discovery and SOC investigations, and drive remediation with RMF and POA&M processes. The role requires TS/SCI clearance and the ability to obtain a CI polygraph.

Collaborative, senior-level expertise is essential. The successful candidate will mentor junior staff, coordinate with ISSOs/ISSMs and system owners,

Qualifications

• Bachelor's degree in a technical discipline; additional 4 years may substitute for degree
• Minimum six years of relevant experience
• Knowledge of vulnerability/exposure management and RMF/security controls
• Experience with ACAS/Tenable, runZero or equivalent tools
• DoD/IC environment experience and TS/SCI clearance preferred

Responsibilities

• Lead complex operational cyber risk and exposure analysis supporting SOC investigations, threat-informed vulnerability prioritization, continuous monitoring, and remediation activities across DoD systems and sites
• Correlate vulnerability data, asset discovery, system criticality, network reachability, security configuration, known controls, threat activity, and SOC findings to identify exposures that present the greatest operational or mission risk
• Analyze vulnerabilities and configuration weaknesses in context, including plausible exploitation paths, adversary TTPs, affected technologies, compensating controls, mission/availability impact, and evidence from active or historical SOC investigations
• Serve as a senior technical resource to Cybersecurity Operations and Threat Analysts for vulnerability, asset, control, and system-security context during complex investigations and proactive hunting activities
• Coordinate with system ISSOs/ISSMs, system owners, engineers, administrators, authorization personnel, and remediation teams to translate SOC-derived findings into actionable mitigation, continuous-monitoring, POA&M, or RMF follow-up as applicable
• Develop and maintain operational exposure-analysis procedures, risk-prioritization methods, technical checklists, TTPs, guides, briefings, and other products that improve consistency and decision quality
• Review remediation evidence, recurring findings, exposure trends, POA&M-related items, and metrics to identify systemic risk, validate corrective actions, and drive closure or escalation
• Support RMF and assessment activities where SOC findings or operational exposure data affect security-control effectiveness, system risk, or authorization posture, while coordinating with the responsible system security personnel
• Mentor Level I and II personnel and review analytical work products for technical accuracy, risk context, completeness, and clear communication

Skills

Vulnerability management

Risk analysis

RMF/security controls

Threat-informed analysis

Education

Bachelor's degree in a technical discipline

Tools

ACAS/Tenable

runZero

STIG Viewer/SCAP

POA&M processes

Job description

Title: Senior Cybersecurity Risk & Exposure Analyst III

Location: Alexandria, VA

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

Job Details

• Lead complex operational cyber risk and exposure analysis supporting SOC investigations, threat-informed vulnerability prioritization, continuous monitoring, and remediation activities across DoD systems and sites
• Correlate vulnerability data, asset discovery, system criticality, network reachability, security configuration, known controls, threat activity, and SOC findings to identify exposures that present the greatest operational or mission risk
• Analyze vulnerabilities and configuration weaknesses in context, including plausible exploitation paths, adversary TTPs, affected technologies, compensating controls, mission/availability impact, and evidence from active or historical SOC investigations
• Serve as a senior technical resource to Cybersecurity Operations and Threat Analysts for vulnerability, asset, control, and system-security context during complex investigations and proactive hunting activities
• Coordinate with system ISSOs/ISSMs, system owners, engineers, administrators, authorization personnel, and remediation teams to translate SOC-derived findings into actionable mitigation, continuous-monitoring, POA&M, or RMF follow-up as applicable
• Develop and maintain operational exposure-analysis procedures, risk-prioritization methods, technical checklists, TTPs, guides, briefings, and other products that improve consistency and decision quality
• Review remediation evidence, recurring findings, exposure trends, POA&M-related items, and metrics to identify systemic risk, validate corrective actions, and drive closure or escalation
• Support RMF and assessment activities where SOC findings or operational exposure data affect security-control effectiveness, system risk, or authorization posture, while coordinating with the responsible system security personnel
• Mentor Level I and II personnel and review analytical work products for technical accuracy, risk context, completeness, and clear communication

Requirements

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum six (6) years of relevant experience in addition to education level
• Demonstrated knowledge of vulnerability/exposure management, threat-informed risk analysis, DoD continuous monitoring, RMF/security controls, network/system security, and technical risk assessment
• Experience with ACAS/Tenable, runZero or comparable exposure/asset-discovery tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, and coordination with SOC/incident-response and ISSO/ISSM functions is desired
• Demonstrated experience leading complex exposure or vulnerability analysis, prioritizing technical risk, coordinating remediation, and translating cyber findings into continuous-monitoring or RMF actions is strongly desired
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled

Salary: $165000 per year