Cybersecurity Risk & Exposure Analyst III

Invictus International Consulting, LLC.; Alexandria (VA); On-site; USD 150,000 - 190,000; Full time

Job summary

Invictus International Consulting, LLC. seeks a Senior Cybersecurity Risk & Exposure Analyst III to lead complex operational risk analyses for DoD systems from Alexandria, VA.

You will correlate vulnerabilities, asset data, and controls to identify exposures with the greatest mission risk. The role requires a technical background, DoD RMF experience, and a current TS/SCI clearance with CI polygraph eligibility; mentoring junior staff and coordinating with ISSOs, owners, and remediation teams are

Qualifications

• Bachelor's degree in a technical discipline; 4 years may substitute for degree
• Six (6) years of relevant experience beyond education
• Knowledge of vulnerability/exposure management and DoD RMF controls
• Experience with ACAS/Tenable, runZero or comparable tools, STIG/SCAP, and POA&M processes
• Experience leading complex exposure or vulnerability analyses and remediation coordination
• Current DoD 8570 IAT II or IAM II certification
• DoD or IC environment experience
• Active TS/SCI clearance with CI polygraph ability

Responsibilities

• Lead complex operational cyber risk and exposure analysis supporting SOC investigations
• Correlate vulnerability data, asset discovery, system criticality, and controls to identify high-risk exposures
• Analyze vulnerabilities with context, including plausible exploitation paths and mission impact
• Serve as senior technical resource to Cybersecurity Operations and Threat Analysts
• Coordinate with ISSOs/ISSMs and owners to translate findings into mitigations and RMF actions
• Develop and maintain exposure-analysis procedures, risk-prioritization methods, and checklists
• Review remediation evidence and trends to drive closure or escalation
• Support RMF and assessment activities impacting security-control effectiveness

Skills

Vulnerability management

Threat-informed risk analysis

RMF/security controls

DoD/IC environment experience

Education

Bachelor's degree in a technical discipline

Tools

ACAS/Tenable

runZero

STIG Viewer

SCAP

POA&M

Job description

Title: Senior Cybersecurity Risk & Exposure Analyst III

Location: Alexandria, VA

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

Job Details:

• Lead complex operational cyber risk and exposure analysis supporting SOC investigations, threat-informed vulnerability prioritization, continuous monitoring, and remediation activities across DoD systems and sites
• Correlate vulnerability data, asset discovery, system criticality, network reachability, security configuration, known controls, threat activity, and SOC findings to identify exposures that present the greatest operational or mission risk
• Analyze vulnerabilities and configuration weaknesses in context, including plausible exploitation paths, adversary TTPs, affected technologies, compensating controls, mission/availability impact, and evidence from active or historical SOC investigations
• Serve as a senior technical resource to Cybersecurity Operations and Threat Analysts for vulnerability, asset, control, and system-security context during complex investigations and proactive hunting activities
• Coordinate with system ISSOs/ISSMs, system owners, engineers, administrators, authorization personnel, and remediation teams to translate SOC-derived findings into actionable mitigation, continuous-monitoring, POA&M, or RMF follow-up as applicable
• Develop and maintain operational exposure-analysis procedures, risk-prioritization methods, technical checklists, TTPs, guides, briefings, and other products that improve consistency and decision quality
• Review remediation evidence, recurring findings, exposure trends, POA&M-related items, and metrics to identify systemic risk, validate corrective actions, and drive closure or escalation
• Support RMF and assessment activities where SOC findings or operational exposure data affect security-control effectiveness, system risk, or authorization posture, while coordinating with the responsible system security personnel
• Mentor Level I and II personnel and review analytical work products for technical accuracy, risk context, completeness, and clear communication

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum six (6) years of relevant experience in addition to education level
• Demonstrated knowledge of vulnerability/exposure management, threat-informed risk analysis, DoD continuous monitoring, RMF/security controls, network/system security, and technical risk assessment
• Experience with ACAS/Tenable, runZero or comparable exposure/asset-discovery tools, DoD STIG/STIG Viewer, SCAP, POA&M processes, and coordination with SOC/incident-response and ISSO/ISSM functions is desired
• Demonstrated experience leading complex exposure or vulnerability analysis, prioritizing technical risk, coordinating remediation, and translating cyber findings into continuous-monitoring or RMF actions is strongly desired
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled