Senior Information Security Analyst

The Senior Information Security Analyst will support the DOE EHSS Application, Infrastructure, and Cybersecurity Support (AICS) program, contributing to the implementation and evaluation of security controls across authorization, continuous monitoring, incident response, and Zero Trust initiatives. This onsite role is based in Germantown, MD.

Program and Mission Context

The AICS program enables secure, reliable, data-driven operations across the DOE enterprise. Scope includes application modernization, DevSecOps support, Zero Trust implementation, continuous monitoring, and infrastructure sustainment supporting EHSS environment, health, safety, security, and classification missions.

Key Responsibilities

• Implement and assess security controls aligned to NIST SP 800-37/800-53, CNSSI, FISMA, FedRAMP, DOE directives, DISA STIGs, and CIS Benchmarks.
• Plan and execute security assessments, SA&A, control testing, technical verification, and scanning for systems, web applications, and configuration posture.
• Produce and maintain authorization documentation, including ATO packages, SSPs, assessment reports, risk statements, corrective actions, and contingency/COOP plans.
• Perform vulnerability analysis, recommend remediation actions, manage POA&Ms, verify closure, and escalate identified risks.
• Support incident response activities, including classified spillage support, cloud security activities, CDM and continuous monitoring, and Zero Trust Architecture support.
• Assist with policy development, SCRM reviews, data calls, annual reviews, training support, and coordination with system owners, administrators, developers, EITS, and iJC3.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Assurance, or a related field.
• Must have an active Top Secret clearance and the ability to obtain a Q clearance.
• Knowledge of SA&A and experience working with NIST SP 800-37, NIST SP 800-53, CNSSI, and federal requirements.
• Understanding of CDM, Zero Trust, cloud systems, incident response, vulnerability management, and risk documentation.
• GISP, CISSP, GSEC, or an equivalent credential.
• Minimum experience: 4 years.

Compensation and Location

• Location: Germantown, MD (onsite)
• Salary range: USD 165,000 - 190,000 per year

Benefits

• Medical, dental, and vision coverage
• 401k matching
• Employee stock purchase program
• Life insurance options
• Time off with pay