Information Assurance Analyst II

Nakupuna Companies is seeking an Information Assurance Analyst II. The Information Assurance Analyst II supports the C5ISR Center cybersecurity program by assessing information system security posture, maintaining compliance and authorization documentation, analyzing vulnerabilities and security risks, and supporting the Risk Management Framework (RMF), FISMA, and applicable C5ISR Center assessment processes, including CORA. This position works with system owners, administrators, the CISO, and the Organizational Information System Security Manager (O-ISSM) to track findings, evaluate controls, maintain audit readiness, and support secure operations across applicable enterprise, application, and laboratory environments.

The following duties reflect management's definition of essential functions for this job but do not restrict the tasks that might be assigned. Management may assign additional duties and responsibilities at any time due to reasonable accommodation or other reasons.

Security Assessment and Risk Management

• Assess and monitor information system security controls, security posture, and compliance with applicable DoD, Army, NIST, and C5ISR Center requirements.
• Conduct security risk analyses, review system changes for security impact, and document recommended risk mitigation actions.
• Analyze vulnerability assessment results, including ACAS findings and applicable endpoint security reports; coordinate remediation with system owners and administrators and validate closure evidence.
• Review security logs, alerts, inspection results, and relevant security events; document and escalate potential incidents in accordance with established procedures.
• Support assessment of security control implementation and effectiveness; identify gaps, exceptions, and residual risks.

Compliance and Documentation

• Develop, review, and maintain RMF and authorization artifacts, including security control documentation, system security plans, supporting evidence, and records in eMASS.
• Support Authority to Operate (ATO) activities, periodic reviews, and ongoing authorization requirements in coordination with system owners and cybersecurity leadership.
• Maintain and track Plans of Action and Milestones (POA&Ms), vulnerability findings, mitigation actions, and documented exceptions through resolution.
• Support FISMA reporting, security audits, inspections, and audit readiness by collecting evidence and ensuring documentation is accurate, current, and complete.
• Maintain security policies, procedures, system inventories, user lists, data flow diagrams, and other required security documentation.
• Review system configurations against applicable DISA STIGs and Security Requirements Guides (SRGs), and coordinate remediation or documentation of deviations.

Operational and Customer Support

• Support cybersecurity priorities established by the CISO and O-ISSM, providing analysis, status reporting, and actionable recommendations.
• Interpret applicable cybersecurity policies and provide information assurance guidance to system owners, administrators, application teams, and other stakeholders.
• Coordinate with technical teams to assess the cybersecurity implications of proposed system, application, network, and architecture changes.
• Support security awareness activities, incident response coordination, and follow-up documentation as assigned.
• Process and track customer requests and cybersecurity actions through the CIO Portal or other approved service management systems.
• Prepare vulnerability, compliance, risk, and authorization status reports for leadership and customer stakeholders.

Education and Experience

• Bachelor's degree in Cybersecurity, Information Technology, or a related field is preferred.
• 5+ years of experience in information security, cybersecurity compliance, information assurance, or related system security functions is preferred.
• Required certification:
• CompTIA Security+ CE or other certification meeting the applicable contract and DoD cyber workforce qualification requirements.
• Preferred certifications (one of the following):
• CISSP
• Certified in Governance, Risk and Compliance (CGRC; formerly CAP)
• CISM
• GIAC Security Essentials (GSEC).
• Experience supporting DoD RMF authorization, eMASS, ACAS, STIG compliance, and POA&M management preferred.

Clearance Requirements: Secret

Location: Fort Belvoir, VA

Physical Requirements: The ideal candidate must at a minimum, be able to meet the following physical requirements of the job with or without a reasonable accommodation:

• Ability to perform repetitive motions with the hands, wrists, and fingers.
• Ability to engage in and follow audible communications in emergencies.
• Ability to sit for prolonged periods at a desk and work on a computer.

The Nakupuna Companies use a market-based compensation strategy to ensure that our employees are compensated within applicable market ranges commensurate with multiple factors, including but not limited to the individual’s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability, organizational requirements, and position location. The projected compensation range for this position is $165,000.00 to $185,000.00 (annualized USD). The salary range displayed represents the typical salary range for this position and is just one component of Nakupuna Companies total compensation package for employees.