Information Security Analyst SME

$145,000 - $165,000/Yr

Crest Security Assurance - Arlington, VA

Full-time - Senior

Remote - Arlington, VA

Professional, Scientific, and Technical Services

About the position

The Information Security Analyst SME is responsible for leading the Risk Management Framework (RMF) assessment, authorization, and monitoring processes for systems in compliance with NIST and ICD 503 standards. This role requires maintaining knowledge of federal cybersecurity policies, performing continuous monitoring, and facilitating risk management decisions through vulnerability analysis and management. The position also involves adapting vulnerability management processes to ensure compliance with FISMA and supporting cloud systems and CI/CD pipelines.

Responsibilities

• Lead the RMF assessment, authorization, and monitoring steps for systems following NIST and ICD 503 standards.
• Maintain ongoing knowledge of Federal policies and practices related to cybersecurity.
• Perform continuous monitoring to facilitate awareness of threats, vulnerabilities, and information security.
• Conduct vulnerability analysis and management, POA&M management, and security impact reviews of change requests.
• Provide access to security-related information for effective risk management decisions.
• Support CONMON efforts for Cloud Systems and CI/CD Pipelines.
• Monitor evolving RMF guidance and adapt vulnerability management processes as necessary.

Requirements

• 10+ years of proven experience performing security controls.
• Active Top Secret (TS) security clearance.
• Excellent verbal and written communication skills.
• Knowledge and experience with assessment & authorization (A&A) application platforms (e.g., eMASS, CSAM, Xacta preferred).
• Strong architecture, network and infrastructure security expertise, particularly in agile/hybrid agile and cloud environments.
• Extensive experience with security methodologies and compliance controls related to cloud security.
• Experience analyzing and trending vulnerability data from heterogeneous devices.
• Expert knowledge in risk and vulnerability management.

Benefits

• 401(k)
• Dental insurance
• Health insurance
• Life insurance
• Paid time off
• Vision insurance