Cloud Security Information Security Risk Analyst

About the Role

The Cloud Security Information Security Risk Analyst is a mid- to senior-level cybersecurity specialist supporting DoW cloud modernization and ongoing sustainment activities. This role defines, communicates, and implements cybersecurity architecture and security assurance processes for systems operating in Microsoft Azure and Amazon Web Services (AWS) across Impact Level (IL) 2 and IL5 cloud environments. The analyst is a core member of a 6-to-8-person Cybersecurity Team, collaborating with the team lead, system engineers, and project managers to ensure secure design, implementation, verification, and continuous monitoring of cloud solutions across multiple network domains. The analyst owns and executes full lifecycle Risk Management Framework (RMF) activities including Authorization and Accreditation (A&A) documentation, security control assessment, and support for achieving and maintaining Authority to Operate (ATO). This role requires leveraging communication and briefing skills to regularly engage with and present security findings to DoW leadership.

Key Responsibilities

• Define, communicate, and implement cybersecurity architecture and security assurance processes for systems in Microsoft Azure and AWS across IL2 and IL5 environments.
• Collaborate with a Cybersecurity Team, team lead, system engineers, and project managers to ensure secure design, implementation, verification, and continuous monitoring of cloud solutions.
• Own and execute full lifecycle Risk Management Framework (RMF) activities.
• Perform Authorization and Accreditation (A&A) documentation.
• Conduct security control assessments.
• Support achieving and maintaining Authority to Operate (ATO).
• Engage with and present security findings to DoW leadership.

Requirements & Tech Stack

• Experience securing systems.
• Experience performing authorization activities.
• Experience writing RMF security documentation.
• Experience with secure cloud architectures such as Azure or AWS.
• Experience developing RMF Body of Evidence for federal systems.
• Experience with compliance tools such as Nessus, ACAS, SCAP, STIG Viewer, SRGs, or eMASS.
• Experience with scripting or automation such as Bash for scanning, monitoring, or compliance support.
• Experience supporting security reviews within DevSecOps pipelines and recurring release cycles.
• Experience with RMF terminology, A&A processes, and federal cybersecurity regulations.
• Top Secret clearance.
• HS diploma or GED.
• DoD 8570 or 8140 IAT Level II Certification.

Nice to Have

• Experience securing IL2 and IL5 cloud architectures and hybrid on-prem and cloud connections.
• Experience with continuous monitoring solutions and Agile-based workflows.
• Experience in Red Hat Enterprise Linux (RHEL) or Windows system administration.
• Experience as an ISSO or ISSE in DoD or federal programs.
• Experience generating A&A artifacts under NIST SP 800-53, DoD RMF, or ICD 503.
• Knowledge of IT system development, acquisition, and sustainment in federal environments.
• Bachelor's degree.

Compensation

• Projected compensation range: $99,000.00 to $225,000.00 (annualized USD).
• The estimated compensation range is typical for the position and is one component of Booz Allen's total compensation package.

Work Model

• This position may be remote, hybrid, or onsite, with expectations aligned to leadership and role requirements.
• When working virtually, cameras are generally expected to be on during meetings.
• Remote positions may still require occasional in-person work at Booz Allen or customer facilities.