Information Assurance Analyst  DoS CSS at RSSi / OneZero Solutions in Washington, DC, USA

Job description

• The Information Assurance Analyst supports SME and Senior Information Security Analysts in operating the Risk Management Framework and continuous monitoring program for DT/EA/CST consular systems. The Analyst develops and maintains authorization artifacts and evidence, runs the weekly and monthly continuous monitoring cadence, supports assessments and contingency plan tests, and captures the meeting minutes and data-call responses that keep systems audit-ready. Analysts who demonstrate proficiency may be assigned as ISSO of record for lower-complexity systems.

Responsibilities

• Develop and update RMF artifacts under the direction of the assigned ISSO: SSP sections and Security Control Implementation Statements, POA&M entries, system inventories, network and data-flow diagrams, SIAs, and CP/IRP/CMP updates.
• Build and maintain the Evidence Index, Inherited Controls Matrix, and System Boundary & Data Flow Package for assigned systems; collect configuration baselines, SOPs, ACLs, screenshots, and log samples as control evidence(RMF Steps 1–3).
• Review iPost scores weekly for assigned systems, identify findings driving elevated risk, and track remediation status; maintain the list of findings open more than 30 days.
• Update POA&M entries in the GRC tool at least monthly and within 5 business days of status changes; gather and attach closure evidence for ISSO validation.
• Review vulnerability and compliance scan results within 5 business days of scan completion; track critical and high findings to BOD timelines; document remediation in POA&Ms.
• Support annual Contingency Plan tests and Annual Control Assessments: draft test plans, coordinate participants, record results and lessons learned.
• Prepare Security Control Review Meeting materials and collect artifacts requested by the Security Control Assessor; assist with control demonstrations(RMF Step 4).
• Capture and distribute meeting minutes for system meetings; maintain action-item logs.
• Assemble Audit and Data Call Response Packages (SSP, POA&Ms, vulnerability reports, assessment results, CP test reports) and respond to HVA, BOD, OMB, OIG, and CDM data calls within DT/EA/CST timelines.
• Register and maintain system records in the GRC tool; support asset inventory andiPostapplication grouping accuracy.
• Collect data for quarterly FISMA metrics and weekly Issue Resolution, Remediation Status, and Risk Acceptance Recommendation reports.

Requirements

• Three (3)+ years of information assurance or cybersecurity compliance experience with hands-on exposure to NIST RMF / FISMA authorization activities.
• Working knowledge of NIST SP 800-53 Rev. 5, SP 800-37 Rev. 2, and FIPS 199, and of SSP, POA&M, and contingency plan structure.
• DoD 8140/8570 IAT Level II or IAM Level I baseline certification (e.g., Security+ CE, CySA+, SSCP, CGRC/CAP) or ability to obtain within 6 months.
• Active, final SECRET security clearance; U.S. citizenship.
• Strong written communication and attention to detail; able to produce Government-format documents.
• Proficiency with Microsoft Word, Excel, PowerPoint, Visio, and SharePoint.
• NIST SP 800-53 Rev. 5 control families and implementation statements; POA&M lifecycle; FIPS 199 categorization.
• GRC platforms (ArchAngel or equivalent) and continuous monitoring dashboards (iPost or equivalent).
• Reading vulnerability and compliance scan results (Tenable, Wiz, STIG Viewer, SCAP).
• Visio, Word, Excel, SharePoint; disciplined version control and document management.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred; an additional four (4) years of directly relevant experience may substitute for the degree.
• CISSP or Associate of ISC2, CGRC/CAP, or CISA.
• Department of State experience; ArchAngel and iPost familiarity.
• Experience interpreting Tenable/Nessus, Wiz, or STIG scan output.
• Familiarity with cloud (AWS/Azure) security concepts and FedRAMP.

Skills

Required

• POA&M lifecycle
• FIPS 199 categorization
• GRC platforms (ArchAngel or equivalent)
• Visio, Word, Excel, SharePoint

Preferred

• Department of State experience
• ArchAngel and iPost familiarity