Senior Information Assurance Analyst

DSA is hiring a Senior Information Assurance Analyst for a full-time position supporting the Environmental Protection Agency (EPA) in the DC Metro area on a hybrid schedule. DSA is the Prime and has worked with this customer on this contract for more than 17 years. The role supports the development and maturation of an Agency-wide information security (InfoSec) program, serving as a subject matter expert on the Risk Management Framework (RMF) and associated information security policies and procedures. Core work hours dedicated to DSA and its direct customers are 8 am to 5 pm EST. The ability to work onsite each week is required. Security clearances may only be granted to U.S. citizens. The posted salary range is a good-faith estimate.

Responsibilities

Advising senior-level stakeholders on InfoSec initiatives including compliance, awareness and training, and security operations; Leading Independent Validation and Verification (IV&V) efforts on security authorization/ATO packages to ensure compliance with agency requirements; Leveraging the existing GRC tool, Telos Xacta (or an alternate like CSAM or RSA Archer), to track and reconcile findings from assessments, audits, and vulnerability scans; Coordinating government data calls (FISMA, FMFIA, BDR, etc.) and monthly reports; Assessing the effectiveness of the InfoSec and privacy training program and leading the collection, analyzing, and presentation of enterprise-level InfoSec performance metrics; Managing InfoSec Program POA&Ms, including advising on remediation efforts; Working closely with senior agency security officials, system owners, information system security officers (ISSOs) and other stakeholders to advise and implement security solutions; Identifying opportunities for efficiencies in work process and innovative approaches; Participating in team problem solving efforts and offering ideas to solve client issues; Conducting relevant research, data analysis, and developing reports; Preparing and assisting in the development of policy and procedures; Implementing processes and procedures to monitor risk across programs/projects; Preparing briefings to the executive team to debrief the results of studies, analyses, and plans; Assisting the client leadership in reviewing monthly project progress, documenting issues, and monitoring resolution

Requirements

Experience with Microsoft Copilot and/or an approved equivalent AI solution; Ability to obtain a Public Trust; Bachelor's degree in information technology or related field and 8 years of relevant IA experience (security certification such as CISSP may substitute for 2 years of experience); Strong data analysis skills; Excellent written and verbal communication skills; In-depth knowledge of applying, selecting and testing the NIST 800-53 Rev 5 security controls; In-depth knowledge of NIST 800-37 Risk Management Framework; Experience with a Governance, Risk and Compliance tool (e.g., Xacta, RSA Archer, CSAM or eMASS); Excellent attention to detail; Ability to handle and prioritize multiple tasks and deadlines

Nice to have

Advanced level cybersecurity certification (e.g., CompTIA CISM, ISC2 CISSP); 3+ years in leadership role