Information Security Analyst Sr Principal

General Dynamics Information Technology (GDIT) is seeking an Information Security Analyst Sr Principal to support federal agency mission needs by achieving and maintaining Authorization to Operate (ATO) for enterprise systems. The position centers on Assessment and Authorization work across all phases of the NIST Risk Management Framework, including environments that involve cloud technologies and Commercial Solutions for Classified (CSfC).

Key Responsibilities

• Achieve and sustain the Authorization to Operate (ATO) for enterprise systems within a federal government agency.
• Categorize information and system components.
• Conduct Privacy Impact Assessments.
• Develop risk management strategies and support related security activities.
• Create and maintain security documentation and required security artifacts.
• Develop Security Control Implementation Statements.
• Develop, track, and follow up on Plans of Action and Milestones (POAM).
• Gather inputs needed to draft security controls, policies, and process documentation.
• Develop Security Impact Analyses (SIA) for system changes and update key artifacts, including the System Security Plan (SSP) and the Information Security Contingency Plan, along with other required security documentation.
• Coordinate with federal government officials to obtain and maintain the system’s ATO.
• Ensure compliance with federal regulations and privacy requirements.
• Investigate information system security violations and incidents, as well as security vulnerabilities, and report findings to management as needed.
• Perform periodic and ad-hoc system audits and vulnerability assessments, including reviews of system scans, audit log reviews, user accounts, application access, file system integrity, and configuration items tied to compliance.
• Use governance, risk, and compliance (GRC) tools such as JCAM, Archangel, or Xacta.
• Participate in Change Management and collaborate with cross-functional teams, customers, and stakeholders to help maintain compliance with security requirements.

Required Qualifications

• Education: Technical Training, Certification(s), or Degree.
• Experience: 8+ years of related experience.
• Technical skills: Information System Security, IT Risk Management, Cyber Security, Compliance, Change Management, Security Control Statements, Security Documentation, and GRC tools (JCAM/Archangel/Xacta).
• Security clearance level: Active Secret; Top Secret Preferred.
• Citizenship: U.S. citizenship required.
• Work requirements: Onsite; travel less than 10%.

Technologies and Frameworks

• NIST Risk Management Framework
• Commercial Solutions for Classified (CSfC)
• Authorization to Operate (ATO)
• JCAM, Archangel, Xacta
• System Security Plan (SSP)
• Information Security Contingency Plan
• POAM
• Security Impact Analyses (SIA)
• CISSP, CompTIA Security+ CE

Certifications

• Certified Information Systems Security Professional (CISSP) (ISC2)
• CompTIA Security+ CE

Location and Work Details

• Location: Sterling, VA (Onsite Workplace)
• Travel Required: Less than 10%
• Clearance Level: Secret
• Category: Cyber and IT Risk Management
• Requisition #: RQ230211
• Requisition Type: Regular
• Public Trust: None

Compensation and Benefits

Salary range: USD 153,000 - 207,000 per year. Salary will be determined based on experience, geographic location, and possibly contractual requirements, and could fall outside of this range.

• 401K with company match
• Comprehensive benefits and wellness packages
• Competitive pay and paid time off
• Internal mobility team focused on helping you achieve your career goals
• Growth: AI-powered career tool that identifies career steps and learning opportunities

Identity Verification Process

• Complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud.
• You are expected to be on camera during virtual interviews.
• GDIT reserves the right to take your picture to verify your identity and prevent fraud.
• Authorize the collection, processing, and use of your biometric data for identity verification and security purposes.