Security Standards And Compliance

Security Standards And Compliance Cybersecurity Jobs

3 jobs found

Today

ISSO Analyst

EY San Antonio, TX

San Antonio, TX

Today

$73k - $109k/yr Full time Emass Fips / Nist Fisma

Apply Now

Job Description

The ISSO Analyst role at EY supports Information System Security Officer (ISSO) and Security Control Assessment (SCA) activities across the NIST Risk Management Framework (RMF) lifecycle for federal information systems. The position centers on maintaining authorization documentation, building evidence packages mapped to NIST controls, supporting assessment readiness, and managing POA&M remediation and continuous monitoring tasks.

Location and Work Setup

Location: San Antonio, TX
Work model: Hybrid

Compensation

Estimated salary: USD 73,100 - 109,200 per year

Key Responsibilities

Support RMF delivery for assigned federal information systems by maintaining documentation and tracking actions, assisting system owners and government security personnel with authorization activities.
Support RMF Prepare by maintaining system information, stakeholder lists, asset and component inventories, authorization boundary information, data-flow documentation, interconnections, and risk context.
Assist with information-type identification, NIST SP 800-60 mapping, and FIPS 199 security categorization, and document rationale and supporting information for review.
Support control baseline selection and tailoring by documenting overlays, scoping decisions, organization-defined parameters, common controls, and system-specific responsibilities.
Draft and update authorization artifacts, including System Security Plans, control implementation statements, inventories, diagrams, assessment-readiness materials, and supporting appendices.
Collect, organize, and map evidence (policies, procedures, configurations, screenshots, tickets, scan outputs, and other materials) to applicable NIST SP 800-53 controls and assessment objectives.
Review implementation statements and evidence for completeness, consistency, and traceability, and escalate gaps or conflicting information to senior team members.
Prepare evidence packages, interview materials, document-request trackers, and response logs to support security control assessments.
Participate in evidence-gathering sessions and control interviews with system owners, engineers, application teams, and assessors, capturing decisions, action items, and follow-up requests.
Assist with drafting assessment responses, findings, risk statements, and corrective actions while preserving assessment independence.
Create and maintain POA&M records, including weaknesses, responsible parties, milestones, scheduled completion dates, remediation evidence, and closure documentation.
Track POA&M progress, follow up on overdue actions, validate evidence submissions, and escalate schedule or risk issues.
Execute continuous monitoring, including scheduled control reviews, vulnerability and configuration reporting, evidence refreshes, and recurring status deliverables.
Support security impact analyses for proposed system changes by documenting affected components, controls, evidence, and authorization artifacts.
Review vulnerability scan results, STIG or CIS benchmark results, and configuration data; connect technical findings to NIST controls and remediation activities.
Maintain accurate system records, workflows, and authorization artifacts in federal governance, risk, and compliance tools such as eMASS, JCAM, CSAM, or Xacta.
Perform first-level quality checks using established templates and checklists to identify missing information, inconsistent dates, unsupported conclusions, and formatting issues.
Track assigned deliverables and commitments, communicate progress clearly, and raise blockers or emerging risks promptly.
Collaborate with engagement team members and client stakeholders, incorporate feedback, and complete assigned work within expected timeframes.
Stay current on federal cybersecurity requirements and continue developing technical, writing, and RMF delivery skills.

Required Qualifications

Education: Bachelor's degree in cybersecurity, information technology, information systems, computer science, engineering, business, or a related field.
Experience: 1-3+ years of experience in cybersecurity, technology risk, compliance, or information technology, including hands-on experience supporting federal RMF activities.
Ability to obtain and maintain a secret level clearance.
Comfort working in a hybrid environment.
Experience developing or maintaining RMF documentation, collecting and organizing control evidence, supporting assessment readiness, tracking POA&Ms, or executing continuous monitoring activities.
Experience developing or maintaining at least one of the following:
- Federal authorization package development and maintenance
- NIST SP 800-53 control implementation statements and evidence mapping
- Security control assessment preparation and response coordination
- POA&M tracking, remediation support, or continuous monitoring reporting
- Federal governance, risk and compliance tools such as eMASS, JCAM, CSAM, or Xacta
- Technical security artifacts such as network diagrams, inventories, vulnerability scans, STIG or CIS benchmark results, change records, or configuration data
Flexibility to travel up to 20%.

Technologies

NIST CSF
NIST 800-53r5
NIST 800-37r2
NIST SP 800-60
FIPS 199
NIST SP 800-53
NIST SP 800-37
NIST 800-53A
FIPS 200
FISMA
eMASS
JCAM
CSAM
Xacta
POA&M
STIG
CIS benchmarks
FIPS 199 security categorization

Benefits

Comprehensive compensation and benefits package
Base salary range (varies by location)
Medical and dental coverage
Pension and 401(k) plans
Paid time off options
Flexible vacation policy
Time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence

Preferred Qualifications

CompTIA Security+, ISC2 CGRC, or another relevant cybersecurity or risk management certification
Prior experience supporting a federal agency, consulting engagement, service delivery center, or managed service

What the Role Emphasizes

Taking ownership of assigned work
Attention to detail in federal RMF delivery
Clear communication and collaboration
Constructive responsiveness to feedback and thoughtful questioning

View full job page →

Today

ISSO Senior Analyst

EY San Antonio, TX

San Antonio, TX

Today

Full time Senior Fisma Fisma Compliance

Apply Now

Job Description

Context: The ISSO Senior Analyst role supports federal systems across the NIST RMF lifecycle by owning authorization workstreams and delivering security control assessment documentation.

Responsibilities

Own RMF delivery workstream for assigned systems by maintaining security posture documentation and supporting system owners and government ISSMs throughout the authorization lifecycle.
Use NIST SP 800-53A assessment procedures alongside NIST SP 800-53 controls and applicable overlays to select examination, interview, and test methods, judge evidence sufficiency, and document objective results with traceability from implementation statements to architecture and evidence.
Develop and maintain core authorization artifacts, including System Security Plans, Security Assessment Plans, Security Assessment Reports, control implementation statements, and supporting appendices.
Perform analysis for information types and impact analysis, including FIPS 199 categorization and NIST SP 800-60 mapping; identify stakeholders and roles; document authorization boundary rationale and risk context.
Define and document system boundary information and authorization boundaries, component inventories, data flows, interconnections, and inherited or shared controls.
Determine control baseline selection, tailoring, overlays, scoping, parameter assignment, compensating controls, and common-control inheritance based on system architecture and hosting model.
Draft findings and create POA&M items linking condition and evidence to control requirements, including threat and vulnerability context, likelihood, impact, recommended action, and acceptance criteria.
Manage POA&M execution for assigned systems, including remediation tracking, evidence validation, closure packages, and deviation or risk acceptance documentation.
Execute NIST 800-137 continuous monitoring and event-driven monitoring activities, including control review cycles, vulnerability management reporting, configuration compliance tracking, and monthly reporting deliverables.
Conduct security impact analyses for proposed changes and document results for system owner review.
Review scan results and STIG or CIS benchmark results; validate findings, distinguish false positives, and connect technical evidence to NIST controls.
Maintain accurate system records and authorization artifacts in governance, risk, and compliance tools such as eMASS, JCAM, and Xacta.
Facilitate evidence-gathering sessions and control interviews with system owners, engineers, and application teams.
Coordinate assigned workstreams, review Analyst deliverables for quality and consistency, provide task-level guidance, manage dependencies, and escalate risk.
Track delivery commitments, monitor schedule and quality risks, and escalate issues to engagement leadership.
Provide day-to-day coaching to Analysts on assessment procedures, evidence expectations, and documentation standards.
Review Analyst work products for accuracy, completeness, and consistency before submission; provide specific, actionable feedback.
Use knowledge of cybersecurity industry trends to identify engagement and client service issues and communicate through written correspondence and verbal presentations.
Stay current on cybersecurity industry trends relevant to delivered services.

Requirements

Bachelor’s degree in cybersecurity, information technology, information systems, computer science, engineering, business, or related field.
Minimum 3 years of related work experience in cybersecurity, technology risk, compliance, or information technology, including hands-on federal RMF support.
Ability to obtain and maintain a secret level clearance.
Comfortable working in a hybrid setting.
Experience developing or maintaining RMF documentation, collecting and organizing control evidence, supporting assessment readiness, tracking POA&Ms, or executing continuous monitoring activities.
Experience in one or more areas such as:
- Federal authorization package development and maintenance.
- NIST SP 800-53 control implementation statements and evidence mapping.
- Security control assessment preparation and response coordination.
- POA&M tracking, remediation support, or continuous monitoring reporting.
- Federal governance, risk, and compliance tools such as eMASS, JCAM, CSAM, or Xacta.
- Technical security artifacts such as network diagrams, inventories, vulnerability scans, STIG or CIS benchmark results, change records, or configuration data.
Flexibility to travel up to 20%.

Technologies

NIST CSF
NIST 800-53r5
NIST 800-37r2
NIST SP 800-53A
NIST SP 800-53
NIST SP 800-60
NIST SP 800-30
NIST SP 800-137
FIPS 199
FISMA
eMASS
JCAM
Xacta
CSAM
STIG
CIS
FISMA and relevant agency-specific policies

Ideally, You’ll Also Have

CISSP, CISM, CISA, CGRC, CIPT, CIPM, CIPP, CRISC, or other relevant certification.
Prior experience supporting a federal agency, consulting engagement, service delivery center, or managed service.

Skills and Attributes for Success

Applied knowledge of federal security frameworks and standards including NIST SP 800-37, 800-53/53A, 800-60, 800-30, 800-137, FIPS 199/200, FISMA, and relevant agency-specific policies.
Applied knowledge of the NIST Risk Management Framework and security control assessment methodology.
Ability to analyze technical information and translate it into clear control documentation.
Ability to manage multiple systems or workstreams concurrently.
Ability to review work products for quality and consistency.
Clear communication with technical stakeholders and engagement leadership.

Location: San Antonio, TX (hybrid)

View full job page →

Today

Research Cybersecurity Analyst

San Diego State University San Diego, CA

San Diego, CA

Today

$7,284 - $10,611/mo Full time Cloud Platforms Cybersecurity Analysis Data Security

Apply Now

Job Description

San Diego State University seeks a Research Cybersecurity Analyst to turn cybersecurity, contractual, regulatory, and sponsor requirements into secure, compliant safeguards for research environments.

Responsibilities

Review research proposals, solicitations, contracts, subcontracts, awards, and data-use agreements to identify cybersecurity, privacy, data-handling, and reporting requirements.
Perform risk, gap, and control readiness assessments; recommend security approaches, remediation strategies, and risk-treatment options.
Partner with researchers, research administration, IT, research computing, and privacy, legal, export control, and compliance teams to interpret and implement applicable requirements.
Interpret sponsor and contractual cybersecurity requirements, including flow-down clauses, reporting obligations, data-handling restrictions, security milestones, and assessment expectations.
Translate contract and regulatory requirements into controls, responsible parties, evidence, and remediation plans.
Assess research data, systems, and workflows to identify indicators of CUI, FCI, PHI, PII, export-controlled information, or other restricted data.
Define and document the scope and boundaries of research environments, including users, cloud services, third-party providers, endpoints, networks, and research equipment.
Explain cybersecurity requirements in practical terms to researchers and research-support personnel.
Coordinate, support, and validate security controls across cloud and on-premises research environments.
Assess security architectures and configurations, including identity and access management, network segmentation, encryption, endpoint protection, logging, vulnerability management, and secure configuration.
Identify security gaps and coordinate remediation.
Support the design, review, and ongoing maintenance of secure research environments and research enclaves.
Develop and maintain SSPs, POA&Ms, inventories, procedures, diagrams, and compliance evidence.
Support sponsor inquiries, audits, and assessments, including CMMC readiness.
Support vulnerability monitoring, remediation, and research-focused incident readiness.
Maintain documentation and processes that demonstrate continued compliance and operational effectiveness after initial assessment or authorization.

Requirements

Experience implementing or assessing NIST SP 800-171, CMMC, NIST SP 800-53, or comparable security frameworks, including developing or maintaining SSPs, POA&Ms, control evidence, and assessment documentation.
Experience securing Windows, Linux, cloud, or research computing environments, including identity and access management, encryption, network segmentation, secure configuration, logging, and vulnerability management.
Ability to conduct security risk, gap, and control assessments, identify remediation or risk-treatment options, and support audit or assessment readiness.
Ability to translate sponsor, contractual, regulatory, and security requirements into technical and procedural controls and communicate them effectively to researchers, technology teams, and leadership.
Working knowledge of research-security requirements, including learning and applying requirements related to CUI/FCI, privacy, federal research awards, HIPAA-regulated information, export controls, and controlled-access research data.
Experience assessing cloud, vendor, and third-party security, including shared-responsibility models and contractual security requirements.
Strong communication, collaboration, and project management skills for managing multiple initiatives across technical, research, administrative, and compliance teams.
Ability to handle confidential, regulated, and sensitive information and adapt to evolving technologies and security requirements.

Technologies

NIST SP 800-171
CMMC
NIST SP 800-53
HIPAA Security Rule
CUI, FCI, PHI, PII
SSPs, POA&Ms
Windows, Linux
Cloud (Azure, AWS, Google Cloud)
Identity and access management, network segmentation, encryption
Endpoint protection, logging, vulnerability management, secure configuration
CISSP, CISM, CCSP, Security+, CySA+, GIAC

Benefits

15 paid holidays, vacation, and sick leave
CalPERS pension plan with retiree healthcare and reciprocal agreements with other California public retirement systems, including the UC
Medical, dental, and vision options at low or no cost
CSU tuition fee waiver for employees and eligible dependents
FlexCash
Life and disability insurance
Legal and pet plans
Access to the library, campus events, employee groups, and volunteer and social activities

Position Information

Full-time (1.0 time-base), benefits-eligible, permanent/probationary position
Exempt under FLSA; not eligible for overtime compensation
Standard work hours: Monday–Friday, 8:00 a.m. to 4:30 p.m., with variation based on operational needs
Eligible for telecommuting up to 3 days per week after a training period requiring on-site presence

Education and Experience

Equivalent to a bachelor’s degree in a related field and four years of relevant experience
Additional experience demonstrating acquired and successfully applied knowledge and abilities may substitute for required education on a year-for-year basis
An advanced degree in a related field may substitute for required experience on a year-for-year basis

Preferred Qualifications

Advanced degree in cybersecurity, information security, computer science, information systems, engineering, or a related field and/or additional progressively responsible cybersecurity experience
Experience supporting higher education or research environments, including secure research environments, CUI/FCI, CMMC readiness, HIPAA-regulated research, or cloud platforms such as Azure, AWS, or Google Cloud
Relevant cybersecurity, cloud, audit, or compliance certifications completed or in progress (CISSP, CISM, CCSP, Security+, CySA+, GIAC, CMMC, or comparable)

Application and Supplemental Information

Apply by October 18, 2026 for full consideration; later applications reviewed on an as-needed basis; position remains open until filled
Mandated reporter under California Child Abuse and Neglect Reporting Act; required to comply with CSU Executive Order 1083
SDSU is not a sponsoring agency for staff or management positions (e.g., H-1B); applicants must be authorized to work in the United States full-time
Employment contingent upon documents demonstrating identity and authorization to work in the United States (consistent with Immigration Reform and Control Act)
Education Code 89521 requirements: disclose sexual harassment final administrative or judicial decision within the last 7 years only after minimum qualifications are met and before an offer
Final-stage applicants must sign a release authorizing CSU to request information from current and/or former employers regarding substantiated misconduct allegations
Background check (including criminal records check) required; conditional offers may be rescinded if disqualifying information is found or if information was knowingly withheld or falsified
SDSU is a smoke-free campus
Reasonable accommodations available for qualified applicants who request an accommodation by contacting Livia Peeples at lpeeples@sdsu.edu

Location: San Diego, CA (hybrid). Salary: USD 7,284–10,611 per monthly. Minimum Experience: 4 years. Education: Bachelor’s degree equivalent in a related field.

View full job page →

Security Standards And Compliance Cybersecurity Jobs

ISSO Analyst

ISSO Senior Analyst

Research Cybersecurity Analyst

Get Security Standards And Compliance Cybersecurity Jobs alerts