Information Assurance Support Analyst

Information Assurance Support Analyst

Astrion has an exciting opportunity for an Information Assurance Support Analyst for the NRC-CPSS Contract, supporting the Civilian Division. Required qualifications/skills include a BA/BS or 5 years additional equivalent experience, 6 years IT experience with 4 years specialized in Information Assurance, Secret Clearance; the ability to obtain an NRC Security Clearance; US citizenship required, and must hold at least one of the following certifications: CompTIA Security+, CISSP, ISACA CISA, GIAC GSEC, GIAC GSNA, GIAC GPEN, CEH, CAP, CASP+, CRISC, or CCSK.

Preferred qualifications/skills include a strong understanding of FISMA and NIST Special Publications, especially NIST SP 800-37 and NIST SP 800-53, excellent written and oral communication skills; attention to detail is a must, experience with vulnerability scanning tools, such as Tenable Security Center, working knowledge of DISA STIGs, SCAP content/audit files, and CIS Benchmarks, understanding of cloud service models (SaaS, PaaS, IaaS) and protections as described in FedRAMP security documentation, experience reviewing FedRAMP authorization packages and understanding how to ensure customer responsibilities are addressed in accordance with the shared responsibility model, experience with performing technical architecture reviews of complex systems with a strong understanding of a system's authorization, knowledge of major cloud platforms (Azure/Amazon Web Services [AWS]), virtualization, networking devices (e.g., routers and switches), web services (e.g., IIS, Apache Tomcat), network security appliances (e.g., firewalls, VPNs), databases (e.g., Microsoft SQL), and intrusion prevention/anti-malware software, knowledge of system and application security threats and vulnerabilities, proficiency with Microsoft Office applications, ability to prioritize and complete tasks efficiently and effectively, comfortable working individually and as part of a team, scripting ability (e.g., PowerShell, VBA) is a plus, familiarity with the use of artificial intelligence (AI) tools such as chat technologies to enhance personal productivity.

Responsibilities include working closely with all levels of personnel, including system administrators, Information System Security Officers (ISSOs), and Authorizing Official (AO), to support FISMA systems through the Security Assessment & Authorization (SA&A), assessing the confidentiality, integrity, and availability impact levels of information stored, possessed, and transmitted by systems to determine the FIPS 199 security categorization, developing and maintaining system security documentation throughout all phases of the NIST Risk Management Framework (RMF), analyzing risks identified during security control assessments and continuous monitoring activities in accordance with NIST SP 800-30, performing and documenting the results of vulnerability scans and configuration compliance checks against configuration standards such as DISA STIGs and CIS Benchmarks, analyzing FedRAMP security packages to document and assess customer responsibility for cloud-based, assisting in the review of monthly continuous monitoring deliverables produced by Cloud Service Providers (CSPs) and annual assessments (produced by third party assessors [3PAOs]) in support of FedRAMP requirements to ensure that cloud services maintain an appropriate risk, creating, tracking, and managing system Plans of Action and Milestones (POA&Ms), and attending project meetings and collaborating with stakeholders to ensure security is addressed throughout the entire system lifecycle.