FISMA Security Analyst

Systems Engineering Solutions Corporation; United States; Remote; USD 120,000 - 170,000; Full time

Benefits offered by this job

Medical

Dental

Vision

AD&D

STD

LTD

Company paid Life Insurance

401k with employer contribution

Paid Time Off

Pet Insurance

Job summary

Systems Engineering Solutions Corporation seeks a SME FISMA Security Analyst to support federal compliance and governance for all SES systems. The role assists the XGen DIGIT Director of Enterprise Security in managing IT Enterprise Security Management and IT Continuity Management Services.

The analyst will contribute to security architecture, risk assessment, RMF lifecycle, and documentation, while ensuring alignment with NIST SP 800-53 Rev.5 and agency baselines.

Qualifications

• Public Trust clearance and ITILv4 Foundation required.
• Security expertise across multiple projects.
• Ability to work independently in remote environments.
• Strong written and oral communication skills.
• Ability to meet DIGIT contract working hours.
• Knowledge across high-impact security tasks.

Responsibilities

• Provides technical support to divisions developing security architecture and supporting design and implementation of information technology security systems.
• Supports research of new security products and services and supports rollout of enterprise security solutions with vendor licenses.
• Leads developing, implementing, and maintaining enterprise-wide information security capabilities.
• Analyzes enterprise business models and IT systems to determine security risks and risk management considerations.
• Defines enterprise- and system-level security requirements.
• Supports implementation and assessment of controls per NIST SP 800-53 Rev.5 and federal baselines.
• Supports RMF lifecycle including control implementation, assessment, and continuous monitoring.
• Assists with RMF/FISMA documentation such as SSPs, SARs, POAs&M, risk assessments, and authorization packages.
• Proposes technical solutions for systems and application-level security architecture to reduce risk and support compliance.
• Supports continuous monitoring activities including vulnerability management, control assessments, risk tracking, remediation validation and reporting.
• Assesses cybersecurity risks for APIs, integrations, data exchanges, and automated workflows with regard to auth, encryption, logging, and data protection.
• Supports API security risk management including design/implementation reviews for compliance and secure config.
• Supports RPA risk management including bots, credentials, logging and resilience.
• Identifies security risks related to intelligent automation and emerging tech with mitigation aligned to risk tolerance.

Skills

Public Trust Clearance

ITILv4 Foundation

Security expertise

Remote work

Communication

Time management

Practical knowledge

Education

Bachelor's degree or equivalent

FISMA experience (3-5 yrs)

Cybersecurity compliance (3-5 yrs)

Continuous monitoring (3-5 yrs)

End-user briefings/training (3-5 yrs)

Job description

SES is seeking a SME FISMA Security Analyst to support the federal compliance and governance requirements for all systems supported by the Task Order. The purpose of this role is to assist the XGen DIGIT Director of Enterprise Security in the management and execution of GSA IT Enterprise Security Management and IT Continuity Management Services.

The team is comprised of the best-in-class technology partners to leverage forward-leaning technologies and best practices to transform GSA’s IT capabilities and shift offerings to provide a more flexible service delivery model, completing the agency’s shift to a fully digital experience along with its adoption of advanced, emerging technologies such as intelligent automation, artificial intelligence, and machine learning.

The FISMA Security Analyst shall perform the following (to include but not limited to) activities:

• Provides technical support to divisions and branches developing security architecture and supporting design and implementation of information technology security systems
• Supports research of new security products and services and supports the rollout of enterprise security solutions that leverage single Department-wide license agreements with new or existing vendors and service providers
• Leads developing, implementing, and maintaining enterprise-wide information security capabilities
• Analyzes the enterprise business models and IT systems to determine security risks and risk management considerations
• Defines enterprise- and system-level security requirements
• Supports the implementation and assessment of security and privacy controls in accordance with NIST SP 800-53 Revision 5 and applicable federal control baselines.
• Supports the execution of the NIST Risk Management Framework (RMF) lifecycle, including control implementation, assessment, authorization, and continuous monitoring.
• Assists with the development, review, and maintenance of RMF and FISMA documentation, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, risk assessments, control implementation statements, procedures, related governance documentation and authorization packages.
• Proposes technical solutions for systems and application-level security architecture and design to reduce risk and support compliance objectives.
• Supports continuous monitoring activities, including vulnerability management, control assessments, risk tracking, remediation validation, and reporting to stakeholders.
• Assesses cybersecurity risks associated with APIs, integrations, data exchanges, and automated workflows, including authentication, authorization, encryption, logging, monitoring, and data protection considerations.
• Supports API security risk management by reviewing API design and implementation for compliance with security requirements, secure configuration, access controls, token management, and protection of sensitive data.
• Supports Robotic Process Automation risk management by assessing bots, workflows, service accounts, credential management, privilege assignments, logging, exception handling, and operational resilience.
• Identifies and documents security risks related to intelligent automation, RPA, API integrations, and emerging technologies, and recommends mitigation strategies aligned with enterprise risk tolerance.

Required Skills:

• Ability to obtain a Public Trust Clearance and ITILv4 Foundation Certification
• Possesses and applies a comprehensive knowledge across key tasks and high impact assignments.
• Functions as a security expert across multiple project assignments.
• Proven ability to work independently in a full and/or partial remote environment with limited supervision and may supervise/lead others.
• Possess the ability to communicate in both oral and written forms, demonstrating an ability to communicate effectively with all levels of staff as well as clients.
• Maintain standard working hours per the DIGIT contract and to be available for meetings, and other collaborative efforts during working hours.
• Demonstrated ability to apply comprehensive knowledge across key tasks and high impact assignments with the ability to use practical experience and training to determine how to accomplish tasks.

Preferred Skills:

• CISSP, CISA, CISM, Security+ or other relevant security certifications
• Familiarity with CUI requirements for unclassified IT systems a plus
• Must have track record of competency in obtaining initial A&A and reauthorization
• Familiarity with Unclassified network administration, specifically with:
  • Network infrastructure and security best practices
  • Local Area Network administration and maintenance, including user control and VPN access
  • Firewalls
  • Mobile Device Management
  • Identity and Authentication Services Management
• Comfortable with Windows operating systems
• Willingness and ability to independently take on a variety of IT Compliance tasks
• Linux operating systems experience
• Familiarity in the Google Suite (Gmail, Calendar, Chat, Meet, Docs, Slides, Sheets), Microsoft Office (Word, Excel, PowerPoint, Outlook) and ServiceNow.

Education and Experience:

• 10 - 15 years of experience and bachelor's degree or equivalent
• Minimum 3-5 years direct experience with supporting FISMA and Financial Audit Requirements
• Minimum 3-5 years of direct experience supporting cybersecurity compliance and implementing steps to mitigate threats
• Minimum 3-5 years direct experience with continuous monitoring security expertise to business units and key stakeholders
• Minimum 3-5 years direct experience creating and delivering end user-related briefings, training, policy, and/or compliance updates
• Experience as a remote worker demonstrating time management and self-discipline with cultural change management and Agile mindset

Physical Requirements:

• If remote, maintain home workspace in a safe manner, free from safety hazards and in line with information security policies.
• Communicate verbally in person, over the phone or by video chat and clearly/succinctly in writing, primarily utilizing a keyboard.
• Appear on camera for meetings with co-workers and government partners via video chat and ensure the protection of proprietary company and customer information is consistent with the company’s expectation of information security.
• Viewing computer screens and sitting for long periods of time.
• Travel is not required.

SES provides a competitive salary and the following benefits:

• Medical
• Dental
• Vision
• AD&D
• STD
• LTD
• Company paid Life Insurance
• 401k with employer contribution
• Paid Time Off
• Pet Insurance