Cyber Security Analyst 3

Pacific Northwest National Laboratory (PNNL) is hiring a Cyber Security Analyst 3 for an onsite role in Richland, WA. In this position, you will independently perform security and privacy control assessments that support Security Authorization (SA) for FISMA systems, including planning, evidence collection, reporting, and recommendations for corrective actions. The work is expected to be onsite 3-4 days per week.

What you will do

• Perform independent security and privacy control assessments in support of Security Authorization (SA).
• Assess existing and new FISMA systems, including subsystems within the system boundary, and communicate results along with the potential implications of identified control weaknesses.
• Develop and execute detailed Security Assessment Plans, including establishing assessment methods aligned to the desired level of assurance.
• Collect assessment evidence and coordinate with stakeholders as needed, including conducting interviews with information system staff and users.
• Draft comprehensive Security Assessment Reports that include findings, an accurate technical evaluation of the system security posture, descriptions of deviations and/or weaknesses and potential impacts or risks, and corrective action recommendations as appropriate.
• Document and provide findings and recommendations that are concise, system-specific, and actionable.

Minimum qualifications

• BS/BA and 5+ years of relevant cybersecurity policy experience, or MS/MA and 3+ years of relevant cybersecurity policy experience, or PhD with 1+ year of relevant cybersecurity policy experience.
• Experience planning assessments and serving as a senior member in a team of security control assessors.
• Experience presenting control requirements and deficiencies to both technical and non-technical audiences.
• Experience performing detailed, full-scope technical security control testing in complex environments.
• Ability to analyze information system configurations and technical specifications against NIST SP 800-53 and other frameworks.
• Experience developing and writing risk-based documentation.
• Experience performing Security Authorization activities, including risk assessments, Security Plans, Security Controls Assessments (SCA), and authorization document development and/or review.
• Knowledge of current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures.
• Ability to obtain and maintain a Top Secret clearance (TS or Q) with access to SCI.
• Ability to obtain and maintain a federal security clearance.
• U.S. Citizenship.

Security clearance and screening information

• Selected applicants will be subject to a Federal background investigation and must meet eligibility requirements for access to classified matter in accordance with 10 CFR 710, Appendix B.
• Security clearance positions are Testing Designated Positions (TDP), requiring pre-employment drug testing and random post-employment drug testing.
• Applicants must demonstrate non-use of illegal drugs, including marijuana, for the 12 consecutive months preceding completion of the QNSP.
• Applicants may be considered ineligible for security clearance processing by the U.S. Department of Energy if the non-use requirement for the prior 12 months cannot be demonstrated.
• PNNL requires completion of HSPD-12 and DOE Order 473.1A steps, including obtaining and maintaining a HSPD-12 PIV Credential after a favorable federal adjudication.
• All tiers of investigation include a declaration of illegal drug activities (including marijuana and cannabis derivatives) within the last 1 to 7 years, depending on the applicable tier.
• For foreign national candidates: if you have not resided in the U.S. for three consecutive years, you are not eligible for the PIV credential and instead will need a favorable Local Site Specific Only (LSSO) Federal risk determination to maintain employment.
• Once the three-year residency requirement is met, a PIV credential will be required to maintain employment.

Technologies you will work with

• NIST SP 800-53
• FISMA
• Security Authorization (SA)
• Security Controls Assessments (SCA)
• Controlled Substances Act

Compensation

USD 140,200 - 228,800 per year.

Benefits

• Medical insurance, dental insurance, and vision insurance
• Robust telehealth care options
• Several mental health benefits and free wellness coaching
• Health savings account and flexible spending accounts
• Basic life insurance and disability insurance*
• Employee assistance program
• Business travel insurance
• Tuition assistance and relocation
• Backup childcare
• Legal benefits
• Supplemental parental bonding leave, surrogacy and adoption assistance, fertility support
• Company-funded pension plan*, and 401(k) savings plan with company match*
• Accrue up to 120 vacation hours per year, plus up to ten paid holidays per year