Cybersecurity Analyst, RMF & ATO at JBS International, Inc. in CA

Job description

• The Cybersecurity Analyst provides cybersecurity, information assurance, risk management, and compliance support across Digital Services initiatives. The role supports Authorization to Operate (ATO) activities, continuous monitoring, security assessments, vulnerability management, and implementation of federal cybersecurity requirements while collaborating with engineering, architecture, product, infrastructure, and program teams throughout the solution lifecycle. The Cybersecurity Analyst will serve as the Information System Security Officer (ISSO) for assigned federal systems and environments.
• This position contributes to cybersecurity governance, develops and maintains security documentation, supports security assessments and audits, and helps ensure digital products, cloud environments, and enterprise technology solutions meet applicable federal security and privacy requirements.

Responsibilities

• Cybersecurity Advisory & Secure Solution Delivery
• Provide cybersecurity and privacy subject matter expertise across digital products, cloud services, enterprise applications, AI initiatives, and technology modernization efforts.
• Advise project teams on identity and access management, security controls, data protection, authorization boundaries, and cybersecurity best practices throughout the system development lifecycle.
• Review technical solutions, architectures, and proposed system changes to identify security risks and recommend appropriate mitigations.
• Collaborate with software engineering, infrastructure, architecture, product, and data teams to integrate security requirements into solution planning, development, testing, deployment, and operational support.
• Support alignment of technology initiatives with applicable federal cybersecurity, privacy, and risk management requirements.
• Risk Management & Compliance
• Support identification, analysis, documentation, and tracking of cybersecurity and compliance risks across systems, applications, cloud environments, and operational activities.
• Conduct or support security assessments, compliance reviews, technical evaluations, and security control validation activities.
• Contribute to governance reviews, technical assessments, risk recommendations, and cybersecurity decision support.
• Assist in developing and maintaining cybersecurity policies, procedures, standards, and implementation guidance.
• Support continuous improvement of security posture, compliance maturity, and enterprise risk visibility.
• Authorization to Operate (ATO) & Security Authorization
• Support Authorization to Operate (ATO) and Security Assessment and Authorization (SA&A) activities throughout the system lifecycle.
• Develop, coordinate, maintain, and update authorization documentation, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and related security artifacts.
• Coordinate security assessments, evidence collection, remediation activities, and documentation required to obtain and maintain system authorization.
• Support authorization decisions by collaborating with governance bodies, Authorizing Officials, Information System Security Managers (ISSMs), system owners, and technical teams.
• Advise project teams on authorization boundaries, security categorization, inheritance, and applicable federal security requirements.
• Support continuous monitoring activities necessary to maintain ongoing authorization.
• Security Operations & Continuous Monitoring
• Coordinate vulnerability identification, remediation tracking, and verification activities in collaboration with engineering, infrastructure, and operations teams.
• Review vulnerability scan results, assess security findings, monitor corrective actions, and track remediation through completion.
• Support security incident response activities through documentation, coordination, evidence collection, corrective action tracking, and lessons learned.
• Monitor changes to systems and cloud environments to help ensure continued compliance with approved security baselines.
• Support internal and external audits through evidence collection, documentation, corrective action management, and audit response activities.
• Governance, Collaboration & Delivery Integration
• Coordinate with project managers, architects, developers, Corporate IT, Data & AI, and governance stakeholders to ensure cybersecurity considerations are integrated throughout project planning and delivery.
• Participate in development of governance materials, executive briefings, technical documentation, reports, and other artifacts requiring cybersecurity or compliance input.
• Promote secure development practices and provide guidance on applicable cybersecurity requirements across Digital Services initiatives.
• Contribute to the continuous improvement of cybersecurity templates, operational procedures, documentation standards, and governance processes.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field.
• 3 years of experience supporting cybersecurity, information assurance, security compliance, enterprise security, or risk management programs.
• 3 years of experience applying federal cybersecurity frameworks and standards, including FISMA, NIST Risk Management Framework (RMF), NIST SP 800-53, FICAM, or comparable federal requirements.
• 3+ years of experience supporting Authorization to Operate (ATO), Security Assessment and Authorization (SA&A), continuous monitoring, or related authorization activities.
• Experience supporting the security lifecycle of one or more FIPS 199 Moderate-impact federal information systems, including security documentation, security control implementation, assessment support, Authorization to Operate (ATO), and continuous monitoring activities.
• Experience developing and maintaining security authorization documentation, including SSPs, SAPs, SARs, POA&Ms, and related security artifacts.
• Experience supporting security assessments, compliance reviews, vulnerability management, audit support, or enterprise risk management activities.
• Experience collaborating with software engineering, cloud, infrastructure, architecture, product, and project teams to integrate cybersecurity requirements into technology solutions.
• Working knowledge of cloud platforms (AWS and/or Azure), identity and access management, secure system development lifecycle (SDLC), and cybersecurity best practices.
• One or more professional cybersecurity certifications such as CompTIA Security+, CompTIA CySA+, ISC2’s Certified in Cybersecurity (CC), Certified in Governance, Risk and Compliance (CGRC), Systems Security Certified Practitioner (SSCP), or an equivalent cybersecurity certification is required.
• Strong analytical, organizational, written, and verbal communication skills with the ability to communicate effectively with both technical and non-technical stakeholders.
• Advanced cybersecurity certifications such as ISC2 CISSP, ISACA CISM, or equivalent.
• Experience supporting FedRAMP-authorized cloud environments.
• Experience with vulnerability management and security assessment tools such as Tenable, Nessus, AWS Inspector, Microsoft Defender, or comparable technologies.
• Familiarity with DevSecOps, secure software development lifecycle (Secure SDLC), or cloud-native application security practices.
• Experience supporting web applications, cloud-native solutions, AI-enabled technologies, APIs, or enterprise business systems.
• Experience supporting privacy, data protection, or governance initiatives within federal environments.

Skills

Required

• Cybersecurity
• Information assurance
• Risk management
• Compliance
• FISMA
• NIST Risk Management Framework (RMF)
• NIST SP 800-53
• FICAM
• Authorization to Operate (ATO)
• Continuous monitoring
• Security assessments
• Vulnerability management

Preferred

• FedRAMP-authorized cloud environments
• DevSecOps
• Cloud-native application security
• Web applications
• Cloud-native solutions
• AI-enabled technologies
• APIs
• Enterprise business systems