Security Analyst II

PBS; Alexandria (VA); On-site; USD 155,000 - 165,000; Full time

Benefits offered by this job

Discretionary bonuses

Insurance options

Paid time off

Job summary

PBS is seeking a Security Analyst II to mature PBS’s governance, risk, and compliance programs, including risk management, policy development, GRC tooling, and AI governance, while providing hands-on security operations support across cloud and on-prem environments.

The role is ~75% GRC program development and ~25% security operations, including incident response and threat detection, with ongoing continuity planning and audits.

Qualifications

• 10+ years in cybersecurity and/or information technology
• 5+ years in cybersecurity GRC (risk management, compliance, policy and governance)
• 4+ years as a security analyst
• 3+ years as a systems engineer or administrator

Responsibilities

• Governance, Risk & Compliance: Build and operate enterprise cyber risk management according to NIST SP 800-53 Rev 5
• Vulnerability management: coverage, prioritization, remediation tracking, metrics
• Develop and maintain cybersecurity policies, standards, and procedures across PBS
• Configure and administer GRC tooling and integrations across security and IT platforms
• Design automation to streamline GRC workflows and evidence collection
• Support AI governance, secure deployment and testing per NIST AI RMF
• Develop business continuity and disaster recovery plans and tabletop exercises
• Support audits and compliance activities with evidence gathering
• Security Operations: monitor systems for cybersecurity events and confirm protection effectiveness
• Lead incident response, containment, and recovery with internal and MSSP teams
• Incorporate lessons learned to improve detection and response
• Advise on AI-driven security operations and processes
• Coordinate with stakeholders to ensure PBS mission support

Skills

GRC program design

Risk assessment

Policy development

Automation of workflows

AI governance

Incident response

Education

Bachelor's degree in cybersecurity or related field

CISSP or equivalent preferred

Tools

GRC platforms (ServiceNow GRC/IRM)

SIEM

GRC tooling integration

Job description

Department

Cybersecurity & Program Management (inactive)

Position Title

Security Analyst II

Department

Cybersecurity & Program Management (inactive)

Corporate Area

PBS Technology

Status

Regular, Full time Exempt

Manager Title

Director, Cybersecurity

Position Overview

The Security Analyst II is responsible for building and maturing PBS’s governance, risk, and compliance (GRC) programs, including risk and vulnerability management, policy and procedure development, GRC tool configuration, automation, AI governance, and business continuity, while continuing to provide hands-on security operations support.

This role is approximately 75% Governance, Risk & Compliance (GRC) program development and 25% security operations, including incident response and threat detection across cloud and on-prem environments.

Key Responsibilities Will Include, But Are Not Limited To

Governance, Risk & Compliance (approximately 75%):'

• Building and operating the enterprise cyber risk management program, including risk identification, assessment, treatment, and reporting aligned to NIST SP 800-53 Rev 5
• Building and maturing the vulnerability management program, including scanning coverage, risk-based prioritization, remediation tracking, and metrics/reporting
• Developing, updating, and maintaining cybersecurity policies, standards, and procedures, and driving their adoption across the PBS ecosystem
• Configuring and administering GRC tooling, including workflow design, control mapping, and integrations with security and IT platforms
• Designing and implementing automation to streamline GRC workflows (e.g., evidence collection, continuous control monitoring, and risk and compliance reporting)
• Supporting the AI governance program, including the secure deployment, monitoring, and testing of AI, aligned to the NIST AI Risk Management Framework
• Developing and maintaining business continuity and disaster recovery plans, documentation, and tabletop exercises
• Supporting audits, assessments, and compliance activities, including evidence gathering and remediation tracking

Security Operations (approximately 25%):

• Monitoring information systems and assets to identify cybersecurity events and verify the effectiveness of protective measures
• Detecting anomalous activity and assessing the potential impact of events
• Executing incident response, containment, and recovery processes, and coordinating response activities with internal and external stakeholders (e.g., MSSPs and vendors)
• Incorporating lessons learned from incidents into detection, response, and recovery processes
• Streamlining security operations workflows using AI
• Additional activities as necessary to support the overall cybersecurity and PBS mission

Requirements For Success

Experience requirement

• Minimum of 10 years’ experience in cybersecurity and/or information technology
• Minimum of 5 years’ experience working in cybersecurity GRC (e.g., risk management, compliance, policy and governance, business continuity)
• Minimum of 4 years’ experience working as a security analyst
• Minimum of 3 years’ experience working as a systems engineer or administrator

Education And/or Certification Requirement

• CISSP, CISA, CISM, CRISC, CGRC, or equivalent GRC-focused certifications desired
• GCIH, GCIA, GMON, GCED, or equivalent GIAC defense focused certifications desired
• Certifications by EC-Council, ISC2, Cisco, Microsoft, Fortinet, CompTIA, Offensive Security, etc. to be considered based on relevance to defensive cybersecurity operations
• Bachelor’s Degree in a related field such as cybersecurity, information technology, or computer science; equivalent combination of education and experience may be considered

Skills And Abilities

• Ability to design, implement, and continuously improve GRC programs and processes, translating frameworks such as NIST SP 800-53 Rev 5, NIST CSF, and NIST AI RMF into practical policies, controls, and procedures
• Ability to configure, integrate, and administer GRC platforms and build automated workflows across security and IT systems
• Ability to participate as a technical lead on all projects requiring cybersecurity expertise and consultation
• Ability to deploy, integrate, configure, and maintain systems which comprise the overall cybersecurity technology stack
• Ability to support incident response activities in coordination with internal teams and Managed Security Services Partners (MSSPs)
• Ability to communicate complex cybersecurity and risk concepts in a clear and concise manner for laypersons unfamiliar with cybersecurity and/or IT concepts
• Desire and ability to help drive organizational adoption and buy‑in of cybersecurity policies and standards across the PBS ecosystem
• Eagerness to develop, grow, and maintain strong inter-team relationships across the business to aid in the accomplishment of the PBS mission

Preferred Qualifications

• Experience configuring and administering GRC platforms (e.g., ServiceNow GRC/IRM, Archer, OneTrust, or similar) and building automation and reporting on top of them
• Strong working knowledge of NIST SP 800-53 Rev 5, NIST CSF, NIST AI RMF, CIS Benchmarks, and business continuity/disaster recovery planning
• Working knowledge of security operations technologies and concepts including DFIR, SIEM, SOAR, EDR, IAM, PAM, DLP, NGFW, IDS/IPS, CASB, MITRE ATT&CK, MSSPs, vulnerability management, application security, and cloud security (IaaS & PaaS)
• Fundamental knowledge of scripting and automation (e.g., PowerShell, Python, JavaScript), email security, MDM, OWASP, malware analysis, LOLBAS, WAF, DNS, Linux, Windows, and MacOS

The base pay range for this position at the beginning of employment is expected to be between $155,000 and $165,000/year.

The total compensation package for this position will also include other elements for eligible employees, including:

• (i) eligibility for discretionary bonuses
• (ii) various insurance options, including medical, dental, vision, hearing, life, accidental death and dismemberment, short-term and long-term disability, and business travel accident insurance
• (iii) identity protection program
• (iv) employee assistance program
• (v) financial and retirement savings benefits including the PBS Retirement Plan 403(b)
• (vi) paid time off (17 days per year), paid sick time benefits (12 days per year), paid parental leave (60 days / 12 weeks ), and paid holidays (12 days per year)

Details of these benefit plans will be provided upon request.

The application window for this position is expected to close on 10/5/2026.

If hired, the employee will be in an “at-will position,” and the Company reserves the right to modify the base hourly rate/salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.

PBS is an Equal Opportunity Employer in accordance with the EEOC and the Commonwealth of Virginia.