Senior Cybersecurity Policy Analyst

etelligentgroup; Bethesda (MD); Hybrid; USD 110,000 - 120,000; Full time

Job summary

eTel seeks a senior policy professional to lead NIH ZTA policy and standards efforts under the OCIO. You will convert federal mandates into NIH policy, align with IS2P and NIST benchmarks, and support governance and policy communications.

Required are a federal cybersecurity policy background and strong technical writing. The role is hybrid at NIH/Bethesda, with eligibility for NIH suitability and PIV credential.

Qualifications

• Bachelor's degree plus 8+ years in federal cybersecurity policy, governance, or compliance.
• Experience with HHS/NIH policy development and approval is preferred.
• Ability to translate federal mandates into actionable NIH policy frameworks.

Responsibilities

• Build the Single Policy Framework for NIH ZTA policy and related standards.
• Trace policy statements to federal sources and to enforcement checkpoints.
• Inventory NIH policies and benchmark against NIST and current threats.
• Develop policy anchors covering identity, devices, networks, and data.
• Write ZTA Policy Briefs and enterprise communications conforming to Section 508.

Skills

Policy development

Federal cybersecurity

Technical writing

Policy drafting

Education

Bachelor's degree

Tools

NIST SP 800-53 Rev 5

NIST SP 800-63-4

Job description

Company Overview

Over the past 15 years, eTel has delivered essential solutions for the federal government by securing and managing data, providing scalable identity access, modernizing legacy systems, and building high-performance platforms. By integrating new technologies and ensuring reliable operations we help agencies stay prepared for future challenges As a premier technology solutions and services company to the US federal government, eTel possesses longstanding relationships across the federal civilian marketplace. Other customers include the broader Treasury Department, Commerce Department, and State Department.

Work Location and On-Site/Telework Requirements

Hybrid - NIH, Bethesda, MD. On site for stakeholder workshops (typically 1-2 days/week during the first 120 days, then as scheduled).

Citizenship

U.S. Citizenship required

Clearance

All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.

Salary Range

$110,000-$120,000 yearly salary

Overview

You will lead Task 5, Security Policy and Standards Support for ZTA Operationalization, under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). Working in the Risk & Policy Pod, you will turn federal and HHS Zero Trust mandates into a single, enforceable NIH policy framework. You will also support Task 6 communications and Task 7 governance.

Responsibilities

• Build the Single Policy Framework (Subtask 5.1): NIH ZTA policy, then standards by pillar, then implementation guides by workload family, then procedures, with an enterprise risk management (ERM) risk-appetite statement at the top.
• Trace every policy statement up to its federal or HHS source (EO 14028, OMB M-22-09, HHS IS2P, HHS ZTA Strategy) and down to the Overlay control, architecture pattern, and governance checkpoint that enforce it.
• Inventory NIH security policies, IS2P-derived standards, and procedures. Benchmark them against NIST SP 800-53 Rev 5, 800-207, 800-63-4, the CISA ZTMM, and current threats (MITRE ATT&CK). Produce a gap register with draft language and an adoption path (Subtask 5.2).
• Develop policy anchors (Subtask 5.3), each made up of the policy statement, the technical setting that enforces it, the evidence that proves it, and the owner. Start with identity (conditional access), devices, networks, and data (classification labels driving DLP).
• Write ZTA Policy Briefs and role-based monthly enterprise communications with the NIH ISAO Communications Team. All content must conform to Section 508.
• Align policy with AI governance (NIST AI RMF, OMB AI memoranda, HHS AI strategy) and with data-management requirements (NIH Data Management and Sharing Policy, Privacy Act, HIPAA where applicable).

Required Qualifications

• Bachelor's degree plus 8+ years in federal cybersecurity policy, governance, or compliance.
• Working knowledge of HHS IS2P, FISMA, NIST frameworks, and OMB M-22-09.
• Experience applying ERM principles to security policy.
• Excellent technical writing and policy-drafting skills.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.

Preferred Qualifications

• HHS or NIH policy development and approval experience.
• CISSP, CISM, or CGRC.
• Zero Trust policy experience; privacy knowledge (Privacy Act, HIPAA, research data).
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.

Commitment to Diversity

eTelligent Group provides equal employment opportunities (EEO) to all applicants without regard to race, color, religion, gender, sexual orientation, gender identity, nations origin, age, disability, genetic information, marital status, amnesty, status as a covered veteran, and any other characteristic provided in accordance with applicable, federal, state and local laws.