Security Analyst – FedRAMP/DoD Compliance & Risk

Sharp Decisions; Herndon (VA); Hybrid; USD 110,000 - 160,000; Full time

Job summary

Sharp Decisions in Herndon, VA is seeking a Security Analyst to join a FedRAMP/RMF-focused cyber team. You will create, update, and maintain security documentation, artifacts, and CCM requirements such as POA&M, and support the Cloud Operations team with vulnerability remediation and policy advisement.

The role requires knowledge of NIST RMF, FedRAMP, DoD policies, and experience with ATO packages, security controls, risk assessment, system categorization, and security authorization

Qualifications

• Understand and document information system specifications and security controls.
• Advise stakeholders on evolving policies (e.g., NIST RMF, DISA SRG).
• Document actions and risk mitigation per FedRAMP and client policy.
• Apply enterprise security frameworks to cloud initiatives.
• Develop/update policies to implement FedRAMP and NIST 800-171 requirements.
• Familiarity with FedRAMP, DoD and NIST controls, including vulnerability management.
• Identify and assess cloud system state, RMF status, and patching mechanisms.

Responsibilities

• Create, update, and maintain FedRAMP-required security documentation and CCM artifacts.
• Assist with Plan of Action and Milestones (POA&M) processes.
• Advise stakeholders on regulatory changes and risk assessment.
• Support Cloud Operations with vulnerability identification and remediation actions.
• Participate in security authorization activities (ATO), control inheritance, and related artifacts.

Job description

Sharp Decisions in Herndon, VA is seeking a Security Analyst to join a FedRAMP/RMF-focused cyber team. You will create, update, and maintain security documentation, artifacts, and CCM requirements such as POA&M, and support the Cloud Operations team with vulnerability remediation and policy advisement.

The role requires knowledge of NIST RMF, FedRAMP, DoD policies, and experience with ATO packages, security controls, risk assessment, system categorization, and security authorization