Cybersecurity Analyst (MSIC)

About the Role

COLSA Corporation is seeking multiple Cybersecurity Analysts for a dual-role position responsible for the design, integration, and formal authorization of complex DoD information systems. You will apply Information System Security Engineering (ISSE) principles to develop secure architectures while executing Information System Security Officer (ISSO) duties to ensure all systems achieve and maintain an Authorization to Operate (ATO) under the current approved version of the RMF. This position requires a deep technical understanding of vulnerability remediation and the ability to translate policy into actionable engineering requirements. Requires on-site work at MSIC in Huntsville, AL.

Key Responsibilities

• Security Engineering & Design: Lead the integration of cybersecurity requirements into the System Development Life Cycle (SDLC); design and evaluate security architectures for compliance with NIST 800-53 and DoD Cyber-survivability requirements.
• RMF Lifecycle Management: Manage the end-to-end Risk Management Framework (RMF) process, including system categorization, control selection, implementation, and continuous monitoring within approved software.
• Artifact Development: Author and maintain a comprehensive Security Authorization Package including the System Security Plan (SSP), Security Assessment Report (SAR), Risk Assessment Report (RAR), and Security Control Traceability Matrix (SCTM).
• Technical Remediation: Direct the application of Security Technical Implementation Guides (STIGs) and Information Assurance Vulnerability Alerts (IAVA); perform root-cause analysis on vulnerability scan results (ACAS/Nessus) to develop mitigation strategies.
• Risk Assessment: Perform formal risk assessments; document residual risks and manage the Plan of Action and Milestones (POA&M) to ensure timely closure of findings.

Requirements & Tech Stack

• NIST 800-53 security controls and their technical implementation.
• Demonstrated experience managing vulnerabilities in DoD environments.
• Authoring and reviewing System Security Plans (SSP), Security Assessment Reports (SAR), and Security Control Traceability Matrices (SCTM).
• Ability to communicate complex cybersecurity situations to non-technical leadership in an actionable form.
• ACAS (Nessus) and SCAP Compliance Checker (SCC).
• System administration security a plus.

Qualifications

• Associate’s degree (or higher) in Cybersecurity, Information Technology, or a related field, or equivalent experience.
• Minimum of 0–12 years of related experience.
• Must possess an active CompTIA Security+ CE, ISC2 SSCP, or equivalent baseline certification.
• U.S. Citizenship required.
• Must possess an active DoD Top Secret clearance with SCI eligibility.
• Candidates must be able to successfully complete a Counterintelligence (CI) Polygraph within 180 days of hire date and meet eligibility requirements for Special Access Programs (SAP).
• Preferred: Holds an active ISC2 CISSP.
• Preferred: Expert at leveraging enterprise tools like SCCM, WMI, and PowerShell to automate the deployment of security patches and configuration changes across workstations and servers.