Cybersecurity Analyst - Zero Trust
On site in Ashburn, VA — Monday through Friday, 8:30am to 5:00pm
The Cybersecurity Analyst - Zero Trust evaluates a large federal agency's enterprise architecture, tools and processes against CISA's Zero Trust Maturity Model, then helps update the agency's Zero Trust Architecture (ZTA) Implementation Plan and Zero Trust Optimization Roadmap across every Zero Trust focus area — Identity, Devices, Networks, Applications & Workloads, Data, Visibility & Analytics, Automation & Orchestration, and Governance. The role supports the ZTA Implementation & Optimization Integrated Project Team (IPT), builds consensus across working groups, tracks ZTA risks, issues and metrics through to resolution, and maintains the dashboards and documentation that communicate ZTA maturity progress by pillar.
Responsibilities:
- Serve as a Zero Trust subject matter expert and strategic consultant to government leadership; help incorporate Zero Trust concepts per OMB M-22-09, CISA's Zero Trust Maturity Model, NIST SP 800-207, the DoD Zero Trust Reference Architecture and EO 14028.
- Evaluate enterprise architecture, tools, configurations and SOPs through a ZTA lens and identify further-adoption opportunities.
- Identify technology and capability gaps; evaluate products and make tool and technology recommendations to mature ZTA capability levels.
- Update the ZTA Implementation Plan and draft and update the Zero Trust Optimization Roadmap across all Zero Trust focus areas.
- Draft and maintain the Security Modernization Strategy and support the ZTA IPT, working groups and consensus-building.
- Prioritize modernization initiatives, track ZTA risks, issues and blockers, and develop and track security modernization metrics.
- Maintain the Security Modernization / Zero Trust JIRA project board and an enterprise Integrated Master Schedule / Gantt chart; develop single-pane-of-glass BI dashboards tracking ZTA maturity per pillar.
- Develop technical documentation, non-technical executive summaries and briefing materials supporting security modernization efforts.
Minimum qualifications:
- At least 5 years of professional experience in information assurance, cybersecurity, risk management or compliance; or a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity or a related field with 3 years of such experience.
- One of the following certifications: ISC2 CISSP, ISACA CISM, ISACA CRISC, GIAC GCED or CEH.
- Experience with Zero Trust fundamentals.
- Ability to work on site in Ashburn, VA (no telework).
- US Citizenship (no dual citizenship) and the ability to pass a federal background investigation in order to be granted access to sensitive information.
Preferred skills:
- Demonstrated knowledge of OMB M-22-09 and the Zero Trust Architecture pillars, the CISA Zero Trust Maturity Model, the NIST Zero Trust Architecture model and the DoD Zero Trust Reference Architecture.
- Experience with risk assessments, NIST SP 800-37 RMF, the NIST Cybersecurity Framework and NIST SP 800-53 security controls.
- Experience with POA&M management, security impact analysis of system design and configuration, and security policy writing.
Compensation: $140,000 - $165,000 per year
#cjpost