RMF Cybersecurity Analyst — DoD/IC Risk & Compliance

Pueo Business Solutions LLC; Virginia; Hybrid; USD 110,000 - 150,000; Full time

Job summary

Pueo Business Solutions LLC is seeking a Cybersecurity Analyst to support RMF lifecycle activities and ensure alignment with DoD and DIA cybersecurity standards. The role focuses on vulnerability management, continuous monitoring, and risk-informed decision-making across information systems.

Collaborate with ISSMs, ISSOs, SCAs, and PMs to execute security controls, maintain documentation, and prepare for audits. Strong communication and cross-team coordination are essential.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Obtain and maintain an IAT Level III certification, or maintain an IAT Level II certification, per DoD 8570.01-M and DoD Directive 8140.
• Acceptable certifications include: CySA+, Security+, CND v3, CCNA Security, GICSP, GSEC, SSCP.

Responsibilities

• Support information systems throughout the RMF lifecycle, ensuring compliance with applicable cybersecurity policies, standards, and regulations.
• Collaborate with ISSMs, ISSOs, SCAs, PMs, and stakeholders to support security initiatives and compliance efforts.
• Assist stakeholders in understanding cybersecurity risks, vulnerability impacts, and remediation priorities to improve system security posture.
• Provide technical support for continuous monitoring activities, compliance reporting, and audit readiness initiatives.
• Evaluate cybersecurity implications of system modifications, upgrades, and configuration changes.
• Support implementation, assessment, and documentation of security controls.
• Maintain and update cybersecurity documentation, authorization packages, and RMF artifacts.
• Document vulnerabilities, misconfigurations, and security findings clearly to support remediation planning and stakeholder awareness.
• Utilize Xacta or similar Cyber Risk Management platforms to manage risk assessments, security control evidence, compliance status, and POA&M activities.
• Track and manage POA&M items to ensure vulnerabilities identified through scans, assessments, or audits are properly documented, mitigated, and resolved.
• Analyze vulnerability and compliance data to identify trends, recurring issues, and opportunities for security improvements.
• Promote cybersecurity best practices and ensure alignment with organizational and mission objectives.

Skills

Verbal & written comms

Vulnerability reports

Analytical thinking

Root-cause analysis

Cross-team collaboration

Prioritization

Security documentation

Education

Bachelor’s degree in Cybersecurity/CS/IT

IAT Level III or Level II (DoD 8570.01-M)

Tools

Xacta

STIG Viewer

ACAS

Prisma

Splunk

Trellix HBSS

Job description

Description

The Cybersecurity Analyst supports the security, compliance, and maintenance of information systems throughout the Risk Management Framework (RMF) lifecycle, from system preparation through decommissioning. This role ensures alignment with Intelligence Community Directive (ICD), Defense Intelligence Agency (DIA), and Department of Defense (DoD) cybersecurity policies and standards.

The analyst works closely with Information System Security Managers (ISSMs), Information System Security Officers (ISSOs), Security Control Assessors (SCAs), Program Managers (PMs), and other stakeholders to execute RMF activities, reduce cybersecurity risk, and improve the overall security posture of supported systems. This position focuses on driving meaningful security outcomes through vulnerability management, continuous monitoring, compliance support, and risk-informed decision-making.

Roles and Responsibilities

• Support information systems throughout the RMF lifecycle, ensuring compliance with applicable cybersecurity policies, standards, and regulations.
• Collaborate with ISSMs, ISSOs, SCAs, PMs, and other stakeholders to support security initiatives and compliance efforts.
• Assist stakeholders in understanding cybersecurity risks, vulnerability impacts, and remediation priorities to improve system security posture.
• Provide technical support for continuous monitoring activities, compliance reporting, and audit readiness initiatives.
• Evaluate cybersecurity implications of system modifications, upgrades, and configuration changes.
• Support implementation, assessment, and documentation of security controls.
• Maintain and update cybersecurity documentation, authorization packages, and RMF artifacts.
• Document vulnerabilities, misconfigurations, and security findings clearly to support remediation planning and stakeholder awareness.
• Utilize Xacta or similar Cyber Risk Management platforms to manage risk assessments, security control evidence, compliance status, and POA&M activities.
• Track and manage POA&M items to ensure vulnerabilities identified through scans, assessments, or audits are properly documented, mitigated, and resolved.
• Analyze vulnerability and compliance data to identify trends, recurring issues, and opportunities for security improvements.
• Promote cybersecurity best practices and ensure alignment with organizational and mission objectives.

Knowledge

• Knowledge of the Risk Management Framework (RMF), NIST 800-series publications, Federal Information Processing Standards (FIPS), Security Authorization and Assessment (SA&A) processes, continuous monitoring, POA&M management, and vulnerability management.
• Understanding of cybersecurity compliance requirements within DoD, DIA, and Intelligence Community environments.
• Familiarity with cybersecurity risk management platforms such as Xacta and related compliance management tools.

Skills

• Strong verbal and written communication skills with the ability to explain technical concepts to both technical and non-technical audiences.
• Experience interpreting vulnerability and compliance reports generated from tools such as Xacta, STIG Viewer, ACAS, Prisma, Splunk, Trellix (HBSS), or similar security platforms.
• Strong analytical, troubleshooting, and problem-solving abilities.
• Ability to identify root causes of security issues and recommend practical remediation strategies.
• Experience working across multiple teams and stakeholders to achieve security and compliance objectives.
• Ability to manage competing priorities while maintaining attention to detail and accuracy.
• Strong organizational skills and ability to maintain comprehensive security documentation.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Obtain and maintain an IAT Level III certification, or maintain an IAT Level II certification, in accordance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management requirements.
• Acceptable certifications include: CompTIA Cybersecurity Analyst (CySA+), CompTIA Security+, EC-Council Certified Network Defender (CND v3), CCNA Security, Global Industrial Cyber Security Professional (GICSP), GIAC Security Essentials (GSEC), Systems Security Certified Practitioner (SSCP)

Clearence

• Active Top Secret clearance is required with SCI eligibility and the ability to Pass CI Poly

Pueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.