Note: The job is a remote job and is open to candidates in USA. Strategic Innovation Group (SIG) is seeking multiple System Security Analysts to support the security, compliance, and risk management of production systems and applications for client programs. This role is responsible for analyzing production systems and applications to identify security vulnerabilities, documenting security requirements, and identifying necessary security controls to protect production environments.
Responsibilities
- Analyze current production systems and applications to identify security vulnerabilities and risks
- Document security requirements for production systems and applications
- Identify and recommend the security controls and control families necessary to secure production environments
- Define and document system security boundaries in coordination with system owners and technical teams
- Inherit, review, and manage current Plans of Action and Milestones (POA&Ms) and prior security findings
- Develop mitigation and implementation strategies to remediate identified vulnerabilities and findings
- Build planning schedules and task timelines to drive POA&Ms toward closure
- Track and report POA&M status and remediation progress to stakeholders
- Conduct control assessments and control testing (e.g., NIST SP 800-53A) to validate control implementation and support audit readiness
- Perform continuous monitoring activities to sustain system authorization and ongoing control effectiveness
- Support audit readiness activities, including review of vendor SOC reports and third-party penetration test results
- Test and maintain contingency plans (ISCP/DRP/IRP) to support system resiliency
- Integrate automated security scanning into CI/CD pipelines and review findings with development teams
- Provide advisory support to program-level security teams and development teams on security best practices and compliance requirements
Skills
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field (equivalent experience considered)
- Must have a relevant certifications (e.g., Security+, CISSP, CAP, or similar) - candidates with certifications will be given priority
- 3+ years of relevant security analysis experience (senior candidates with more experience encouraged to apply)
- Demonstrated experience conducting security assessments of production systems and applications
- Working knowledge of security control frameworks and control families (e.g., NIST SP 800-53 or equivalent)
- Experience managing and remediating POA&Ms and security findings, including inherited/legacy findings
- Ability to develop mitigation and remediation plans, including task sequencing and scheduling
- Experience conducting formal control assessments/testing to validate control implementation
- Experience with continuous monitoring processes and sustaining system authorization
- Experience reviewing third-party/vendor risk artifacts (e.g., SOC reports, penetration test results)
- Strong written communication skills for documenting security requirements and findings
- Experience advising both security and engineering/developer teams on remediation approaches
- Must be a US Citizen and able to obtain a Public Trust Clearance
- Familiarity with Risk Management Framework (RMF) processes
- Experience with vulnerability scanning and reporting tools
- Familiarity applying security controls to Cloud applications
Benefits
- Great work/life balance
- Eligibility for performance-based participation in cash bonuses
- Potential to participate in growth of the company through incentives
- Excellent benefits, including health, dental, vision, generous PTO, a 401(k) with match, life insurance, short- and long-term disability, and a health savings account (HSA)
Company Overview