Cybersecurity Risk Analyst

- Draft, manage, enhance, and sustain Assessment and Authorization (A&A) documentation and processes (such as SSPs, SARs, POA&Ms, security inventories, PTAs, and PIAs), ensuring they are complete, accurate, and compliant with NIST Risk Management Framework (RMF) requirements and NSF standards. - Conduct control assessments by evaluating technical, procedural, and operational evidence; document findings, and assist in risk evaluations, POA&M management, and ongoing authorization processes. - Collaborate with system stakeholders, Information System Security Officers (ISSO), and engineers to collect evidence, confirm control implementations, and maintain authorization packages throughout the system lifecycle. - Carry out cybersecurity assessments and formulate a continuous monitoring strategy for cloud services in line with FedRAMP and federal regulations. - Assess External Services (e.g., SaaS, PaaS, IaaS) for integration within authorization limits by analyzing service documentation, evaluating controls, and documenting related risks and shared responsibility models; review FedRAMP authorization packages for relevance and to identify gaps. - Aid in continuous monitoring and Security-Focused Configuration Management by analyzing vulnerabilities and configuration data (e.g., scanning results), validating remediation measures, and identifying trends or systemic risks across systems. - Tailor DISA STIGs and CIS Benchmarks to develop and uphold standardized gold audit files for NSF systems; utilize Tenable Security Center to bolster the Security-Focused Configuration Management process. - Engage in broader risk management initiatives, including pinpointing cross-system risks, assisting with audit and compliance tasks (e.g., OIG), and integrating findings from evaluations, incidents, and external reviews into risk management and reporting. - Conduct peer reviews of A&A materials and related documents to ensure technical fidelity, consistency, and compliance with established standards; contribute to team outputs and foster coordination among Cybersecurity Oversight and Compliance activities. - Perform other job-related tasks as assigned.