Cybersecurity Analyst/Engineer

Cybersecurity Analyst/Engineer

Location: Arlington VA

Job Status: Full time

Clearance Required: Active DoD TS/SCI 

Astrion is seeking a Cybersecurity Analyst/Engineer to join our prime contract supporting Headquarters Space Force S6 (SF/S6) in Arlington VA. This position supports the Authorizing Official (AO) as a Security Control Assessor Representative (SCAR) with independent assessments and technical analysis across the Enterprise. The work spans early prototype efforts through programs of record preparing for milestone decisions and operational fielding ensuring the secure operations of enterprise networks, mission-critical systems, and sensitive data across the Authorizing Official's multiple enclaves.

You will play a hands-on role in Cybersecurity Analysis, Engineering, and Risk Management Framework (RMF) compliance, driving mission assurance for some of the nation's most important space systems.

REQUIRED QUALIFICATIONS / SKILLS

• 7–12+ years of cybersecurity experience in DoD, USSF, or IC environments.
• Active DoD TS/SCI clearance (with current investigation).
• CompTIA Security+ or equivalent DoD 8570/8140 IAT/IAM/IASAE certification.
• Demonstrated proficiency with RMF assessments and technical cybersecurity evaluation.
• Hands-on experience with eMASS and/or XACTA

PREFERRED QUALIFICATIONS / SKILLS

• Experience supporting Authorizing Officials, SCAs, or executing enterprise-level cyber governance and Risk Management Framework (RMF) protocols.
• Senior-level cybersecurity certifications or equivalents (e.g. CISSP, CAP, CCSP, GSLC, GIAC).
• Knowledge of FedRAMP, FISMA, Clinger-Cohen Act, ITAR, PPP, SCRM, and other related requirements.
• Strong organizational, interpersonal, and communication skills with attention to detail.
• Advanced skills in Microsoft Word, Excel, PowerPoint, and Outlook.

RESPONSIBILITIES

• Perform detailed evaluations of system control implementations across traditional, hybrid, and cloud environments, verifying evidence accuracy and alignment with RMF requirements.
• Review security configuration settings, logs, identity integrations, and network boundaries to validate technical control effectiveness.
• Independently manage and maintain RMF documentation within eMASS or XACTA, ensuring consistency across SSP, SAP, SAR, POA&M, and supporting artifacts.
• Analyze STIG/SCAP results, vulnerability findings, and ACAS/Nessus outputs to determine relevance, categorize risk, and recommend remediation paths.
• Participate in technical assessment sessions with system teams to review evidence, clarify control expectations, and document findings.
• Coordinate directly with ISSMs, ISSOs, engineers, program managers, and development teams to resolve evidence gaps and ensure control implementations are properly documented.
• Assess the cybersecurity implications of system changes, configuration updates, enhancements, and engineering modifications.
• Support readiness evaluations for systems entering key systems engineering milestones, such as PDR, CDR, TRR, and developmental or operational testing.
• Contribute to ongoing continuous monitoring, including tracking vulnerability deltas, cloud security indicators, IAM changes, and compliance drift concerns.
• Participate in working groups, inheritance discussions, and cyber technical exchanges to ensure assessment activities remain aligned with enterprise patterns and expectations.
• Prepare routine assessment updates, summarizing evidence maturity, outstanding risks, and documentation status for SCA or AO staff.
• Conduct recurring quality checks of RMF documentation for completeness, accuracy, and alignment across system artifacts and lifecycle stages.
• Support audit readiness efforts by validating documentation completeness, reconciling findings, and preparing systems for internal or external assessments.
• Identify recurring cybersecurity trends, recurring weaknesses, or risk patterns across systems within the portfolio and communicate observations to senior assessors.
• Assist systems preparing for ATO renewals or approaching acquisition or engineering milestones by reviewing documentation maturity, control implementation evidence, and cybersecurity integration.
• Collaborate with senior assessors on complex assessments, major ST&E events, and risk analysis activities, providing detailed technical inputs as needed.
• Participate in cloud and architectural discussions to verify consistency between system implementation and enterprise-level identity and Zero Trust patterns.
• Support boundary updates, inheritance reviews, and RMF Step 6 continuous monitoring activities by validating control reassessments and documenting posture changes.