Cyber Security Analyst III

The SRC Navy Cryptologic Systems (NCS) Directorate supports a number of U.S. Navy Programs, including the Cryptologic Carry-On Program (CCOP), Ships Signals Exploitation Equipment (SSEE) Program, and Distributed Common Ground System – Navy (DCGS-N). We specialize in engineering support, software development, integration, testing, technical writing, cybersecurity (administration, policy and engineering), production, technical support, warehousing, drafting, repair and management. The Information Systems Security Officer (ISSO) supports the security authorization and continuous monitoring of NCS Family of Systems in accordance with applicable NIST, DoD, Navy, and NAVINTEL cybersecurity requirements. The ISSO is responsible for independently managing assigned systems' RMF activities, maintaining authorization documentation, tracking security compliance, coordinating remediation efforts, and ensuring security requirements are met throughout the system lifecycle.

Responsibilities include:

• Developing, reviewing, and maintaining A&A documentation and the system Body of Evidence to support initial authorization, ongoing compliance, and continuous monitoring activities
• Executing and maintaining RMF activities in Xacta, including security control implementation status, assessment results, supporting evidence, POA&Ms, remediation actions, and authorization package updates
• Managing assigned systems security posture and authorization status, identifying compliance gaps, tracking security risks, and coordinating corrective actions to maintain compliance with applicable requirements
• Conducting and coordinating security compliance assessments using tools and processes such as ACAS/Nessus, Security Content Automation Protocol (SCAP), DISA STIGs, and applicable endpoint protection and security monitoring solutions
• Reviewing vulnerability assessment results, security findings, configuration compliance, patch status, and other security metrics; coordinating corrective actions with system owners, system administrators, ISSEs, engineers, and developers
• Managing POA&Ms from identification through closure, including documenting findings, tracking remediation milestones and due dates, validating supporting evidence, and escalating overdue items and unresolved risks as appropriate
• Supporting the implementation, assessment, and continuous monitoring of technical and operational security controls in accordance with applicable security policies and system requirements
• Reviewing security events, audit findings, and available security monitoring data to identify potential indicators of compromise, suspicious activity, unauthorized access, or inappropriate data transfers; coordinating investigation and reporting as required
• Ensuring proposed system changes, software installations, and configuration modifications follow established configuration management, change management, and security approval procedures
• Supporting and, when formally authorized and qualified, performing Site Based Security Assessments (SBSAs) and providing security assessment results and authorization recommendations to the Designated Authorizing Official (DAO) or other designated government authority
• Reporting and coordinating security incidents in accordance with the applicable Command Incident Response Plan (CIRP) and established reporting requirements
• Advising system stakeholders on cybersecurity compliance, authorization requirements, security risks, remediation priorities, and required corrective actions
• Maintaining accurate security records, tracking authorization milestones, and providing status reports to government and program leadership
• Ensuring assigned systems are operated, maintained, and disposed of in accordance with applicable security policies, procedures, and authorization conditions

#LI-LL1

• Minimum of five years of relevant cybersecurity, Information Assurance (IA), or information systems security experience, including experience performing ISSO or equivalent RMF responsibilities
• Must meet applicable DoD 8140 qualification requirements for the assigned cybersecurity work role, including the required IAT Level II certification (e.g., Security+ CE or another approved certification, as applicable)
• Working knowledge and practical experience with Risk Management Framework (RMF) Revision 4 and Revision 5 processes, workflows, security control implementation, assessment, authorization, and continuous monitoring
• Demonstrated experience independently executing and managing RMF activities for assigned information systems through authorization and continuous monitoring, including security control implementation and assessment, Assessment and Authorization (A&A) documentation, evidence management, and authorization package maintenance
• Experience developing, reviewing, maintaining, and updating System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), security assessment evidence, vulnerability assessment results, and other applicable Assessment and Authorization (A&A) artifacts
• Experience with ACAS/Nessus, DISA Security Technical Implementation Guides (STIGs), and eSTIG assessment and remediation processes
• Demonstrated proficiency using Xacta to manage assigned systems' RMF activities, including documenting and updating security control implementation and assessment status, maintaining assessment evidence, identifying and tracking noncompliant and non validated controls, managing POA&Ms, maintaining authorization status, and generating reports
• Demonstrated experience managing POA&Ms from identification through closure, including documenting findings and risks, developing and tracking remediation milestones, coordinating corrective actions with system administrators, Information Systems Security Engineers (ISSEs), engineers, and developers, validating closure evidence, monitoring due dates, and escalating overdue or unresolved findings
• Demonstrated ability to independently manage assigned systems' security posture, RMF deliverables, compliance findings, and authorization milestones with minimal oversight, while effectively coordinating with technical teams and government stakeholders to resolve security issues and maintain authorization requirements
• Ability to manage multiple systems, competing priorities, and time-sensitive security deliverables while maintaining accuracy and meeting established deadlines
• Strong written and verbal communication skills, with the ability to communicate security findings, compliance gaps, risks, and remediation requirements to technical teams and program stakeholders
• Ability to adapt to evolving cybersecurity requirements, tools, and processes and contribute to continuous process improvement
• Must be capable of meeting applicable qualification and appointment requirements to serve as an ISSO for NCS systems within six months of employment

• Experience supporting Windows and Linux/UNIX-based information systems, with a working knowledge of network architecture, networking devices, and security boundaries
• Knowledge of DISA STIG requirements and configuration assessment techniques for relational and NoSQL databases, including Microsoft SQL Server, PostgreSQL, MongoDB, MariaDB, and MySQLKnowledge of web server technologies, including Apache HTTP Server and Apache Tomcat
• Experience with container security, containerized environments, and DevSecOps practicesAbility to interpret system architecture and data flows and develop clear network topology, boundary, and data flow diagrams
• Experience with NAVINTEL IA enterprise services and applicable Navy cybersecurity policies and procedures
• Experience with Xacta 360, HBSS/Trellix, ACAS/Nessus, and Splunk
• Experience implementing, assessing, or monitoring Zero Trust security requirements
• Experience supporting security audits, vulnerability assessments, continuous monitoring, security incident response, and authorization reviews in a DoD or Intelligence Community environment

SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT. THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS A U.S. GOVERNMENT SECURITY CLEARANCE AT THE TOP SECRET / SCI LEVEL.

• UP to 10%

Scientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.

SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.

Scientific Research Corporation is an equal opportunity employer that does not discriminate in employment.

All qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other protected characteristic under federal, state or local law.

Scientific Research Corporation endeavors to make www.scires.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact [email protected] for assistance. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.