Senior Security Analyst (A&A)/Assessor - NIST

ITC Federal, Inc.; Gaithersburg (MD); Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health

Dental and Vision

401(k)

Flexible Spending Account (FSA)

11 Paid Federal Holidays

PTO

education reimbursement

Job summary

ITC Federal, Inc. seeks a Senior Security Analyst/A&A SME to lead Assessment & Authorization activities for NIST systems in a fully remote role.

You will leverage expertise in NIST RMF, security policy, and vulnerability management to support government missions and regulatory compliance. Ideal candidates bring 5–8 years of relevant federal experience, CISSP/CISM/CISA or equivalent, and hands-on use of security tools such as RSA Archer, Tenable, and WebInspect.

Qualifications

• 5-8 years of experience implementing the NIST 800-series publications.
• Experience with NIST RMF risk management activities including interviewing, examining and testing control sets.
• Ability to create and update System Security Plans, Contingency Plans, Privacy Threshold Assessments and related docs.
• Delivering risk and vulnerability briefings to management and government customers.

Responsibilities

• Conduct A&A activities for NIST systems individually or as part of a team.
• Collaborate with NIST staff to remediate risks and provide policy-driven solutions.
• Support remediation plans for A&A findings and guide ISSOs on documentation.
• Coordinate/conduct vulnerability scans and analyze results.
• Prepare Security Assessment Reports covering technical and policy aspects.
• Review and update A&A packages based on management feedback.

Skills

A&A expertise

NIST RMF

Vulnerability assessment

Technical writing

Customer service

Policy guidance

Education

Advanced degree in CS or related field

CISSP/CISM/CISA certification

Tools

RSA Archer

CSAM

Tenable

WebInspect

AppDetective

Job description

Overview

JOB TITLE: Senior Security Analyst/A&A SME

GOVERNMENT AGENCY: NIST – National Institute of Standards & Technology

POSITION INFORMATION: Full-Time Position; Government contractor supporting NIST

LOCATION: Fully remote

BENEFITS:

• Health
• Dental and Vision
• 401(k)
• Flexible Spending Account (FSA)
• 11 Paid Federal Holidays
• PTO
• education reimbursement

ITC Federal, LLC (ITC) connects technology advancements in automation and AI, customer experience, and financial services to solve government mission challenges, enabling smoother operational efficiency and bolstering national security. We leverage the latest technology innovations and proven approaches to better serve the mission and support the DHS, DOJ, and DoW workforce, customers, and programs, regardless of scale or complexity. ITC is located in Fairfax, VA and offers outstanding compensation and benefits plan and a challenging and rewarding professional work environment.

Senior Security Analyst will be focused on Security Assessment & Authorization (A&A) of systems for the National Institute of Standards and Technology (NIST). The Senior Security Analyst is expected to be capable of lending subject matter expertise while performing A&A activities. The Senior Security Analyst will demonstrate a strong knowledge of Security Requirement Analysis, Security Architecture , Enterprise Security Program Assessment, evaluating Vulnerability Assessment results and perform other duties as required.

Responsibilities

RESPONSIBILITIES:

• Conducting A&A activities for NIST systems working individually or as part of a team.
• Work with NIST staff to provide technical and policy driven solutions to remediate or mitigate identified risks.
• Support system personnel with remediation plans for A&A findings.
• Provide guidance to Information System Security Officers (ISSO) on system documentation.
• Coordinate/conduct vulnerability scans and analyze results.
• Complete Security Assessment Reports involving both technical and policy related aspects of the assessment.
• Review and update A&A packages based on management feedback.

Qualifications

• 5 - 8 years of experience implementing the NIST 800 Series Special Publications.
• Demonstrable experience:
• Conducting IT assessor activities based on the NIST Risk Management Framework, to include the interviewing, examining and testing of related control sets; the review and/or updates of core system documents- System Security Plans, Contingency Plans, Privacy Threshold Assessments, hardware and software inventories, and system diagrams.
• Performing Security Test and Evaluation and developing Security Assessment Reports for NIST senior management.
• Delivering risk and vulnerability briefings confidently to management and government customers.
• Experience working with vulnerability data, writing Assessment Reports, POA&Ms and Risk Acceptance justifications
• Knowledge of the formation and implementation of IT security policies to ensure confidentiality, integrity and availability of information systems.
• Strong technical oral, writing and customer service skills as you will regularly interact with NIST colleagues and senior managers.

PREFERRED:

• Prior federal or GOVCON experience
• Cloud Experience (AWS or Azure)
• Active Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Security Auditor (CISA) or comparable certification
• Advanced Degree in computer science or related field or related experience
• Direct experience with NIST or other academic environments.
• Expertise with COTS based security tools (i.e. RSA Archer, CSAM, Tenable, WebInspect, AppDetective) used to establish security baselines and assess continuing compliance.

SECURITY CLEARANCE REQUIREMENTS:

• Ability to successfully pass a National Agency Check with Local Agency Check (NACLC)

WORK ENVIRONMENT AND PHYSICAL DEMANDS: Candidate must be able to function in general office environment.

ITC Federal is an equal opportunity employer and will not discriminate against any application for employment on the basis of age, race, color, gender, national origin, religion, creed, disability, veteran status, marital status, sexual orientation, genetic information, military status, disability, or sex including pregnancy and childbirth or related medical condition or on any other basis prohibited by law.