Security Analyst

● Brief Description: The Security Analyst supports Risk Management Framework, cybersecurity compliance, Authority to Operate, and continuous monitoring activities across a complex, mission-critical cloud platform hosted in AWS GovCloud supporting 300+ applications and services. This role performs vulnerability scanning, security documentation management, Plan of Actions and Milestones tracking, audit support, credential and account management, and security posture reporting, ensuring continuous compliance with Federal and VA security requirements across all platform and tenant authorization boundaries.

● Responsibilities:

○ Conduct ad hoc, prescribed, and recurring vulnerability scans for the platform and all hosted applications using Nessus and approved scanning tools

○ Document and report scan findings in accordance with VA RMF and POA&M processes including uploading results to the appropriate scan repository and maintaining the Continuous Authorization and Monitoring system security posture

○ Create and maintain Plan of Actions and Milestones within SNOWCAM, ensuring proper alignment to NIST security families and Control Correlation Identifiers, with periodic review and updating of milestones and mitigation plan details

○ Draft and maintain POA&M verbiage clearly depicting mitigation strategies and timelines, closing out POA&Ms once mitigated, overcome by events, or no longer relevant

○ Maintain program security documents, diagrams, and RMF artifacts including Privacy Threshold Analysis, Privacy Impact Analysis, Security Impact Analysis, Business Impact Analysis, Data Security Categorization, hardware and software lists, and Ports Protocols and Services Management documents

○ Collaborate with application development teams and platform architects to establish and maintain Interconnection Diagrams, High-Level Diagrams, and security assessment boundary diagrams

○ Support all security audits including Inspector General audits, Security Assessmen...