Supports federal cybersecurity risk management and authorization activities, including ATO packages, NIST RMF implementation, security control assessments, vulnerability remediation, POA&M tracking, continuous monitoring, audit readiness, privacy documentation, and incident or contingency planning. Coordinates with ISSOs, engineers, system owners, project managers, and VA stakeholders while maintaining compliance records in ServiceNow and GRC tools.
Clearance: Ability to obtain and maintain a Public Trust
Salary Range: 80K-90K
LTS is seeking an experienced Cybersecurity Analyst to support cybersecurity, risk management, and security authorization activities across multiple projects within the U.S. Department of Veterans Affairs (VA) Health portfolio.
The analyst will provide hands-on support for the Risk Management Framework (RMF), Authority to Operate (ATO) processes, security control assessments, vulnerability remediation, continuous monitoring, and security and privacy documentation. This role requires independent execution of assigned deliverables and close coordination with Information System Security Officers (ISSOs), technical teams, project managers, and VA stakeholders.
The Health PMO support contract provides IT program management, project management, technical management, financial management, functional planning, and documentation analysis in support of the Enterprise Program Management Office (EPMO) Enterprise Program Management Division (EPMD) Health Portfolio
The VA Health Portfolio is focused on development and execution of quality IT projects that address the needs of Veterans and health care providers through management of healthcare information and sustainment of production software to keep the mission going.
What You’ll Do:
- Support development, maintenance, and updates of ATO packages, security authorization artifacts, and related documentation.
- Apply NIST RMF, NIST SP 800-53 Revision 5, VA Handbook 6500, and applicable federal and VA cybersecurity requirements to assigned systems and projects.
- Review and document security controls; support security control assessments, authorization activities, and continuous monitoring.
- Coordinate with ISSOs, system owners, engineers, and project stakeholders to identify security risks and address authorization requirements.
- Develop, evaluate, maintain, and track Plans of Action and Milestones (POA&Ms) from identification through documented closure.
- Review vulnerability scan results, analyze findings, coordinate corrective actions, and track remediation status.
- Support system scanning, audit readiness, High Value Asset (HVA) reviews, and other mandated security assessments.
- Prepare and maintain security and privacy artifacts, compliance reports, standard operating procedures, and supporting program documentation.
- Assist with contingency planning, incident response and disaster recovery documentation, and related exercises or testing.
- Support Privacy Impact Assessments (PIAs), Privacy Threshold Analyses (PTAs), and other applicable privacy documentation.
- Maintain accurate records and status updates in ServiceNow, governance, risk, and compliance (GRC) platforms, and other authorized tracking tools.
- Work with application development, operations, security architecture, and engineering teams to integrate security requirements throughout the system development lifecycle.
- Support security activities for IT modernization, application maintenance, cloud-related initiatives, and Agile delivery teams.
- Communicate security risks, remediation priorities, deliverable status, and process improvement recommendations to program and government stakeholders.
- Manage multiple assignments and deadlines independently while collaborating effectively in a remote team environment.
What We’re Looking For:
- Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Information Technology, or a related field, plus at least five years of relevant professional experience; an additional five years of relevant experience may substitute for the degree.
- At least five years of relevant cybersecurity, information assurance, or federal security compliance experience.
- Hands-on experience supporting ATO processes for systems or applications at the VA or another federal agency.
- Practical experience applying NIST RMF, including security control documentation, assessment, authorization, and continuous monitoring.
- Strong working knowledge of FISMA, NIST SP 800-53, and applicable federal cybersecurity requirements; familiarity with HIPAA and HITECH requirements in healthcare environments.
- Experience developing and maintaining security authorization packages, assessment evidence, and compliance artifacts.
- Demonstrated experience creating, evaluating, tracking, and closing POA&Ms, including coordination of remediation actions.
- Experience analyzing vulnerability findings, coordinating mitigation, and tracking issues through resolution.
- Experience using enterprise GRC or security compliance tracking tools and a ticketing or workflow platform such as ServiceNow.
- Experience supporting security control assessments, cybersecurity audits, or compliance reviews.
- Strong analytical, technical writing, communication, and stakeholder coordination skills; ability to perform hands-on work independently in a collaborative remote environment.
- Current CompTIA Security+, GIAC GSEC, ISC2 CISSP, ISACA CISM, or another cybersecurity certification approved for the position.
- Ability to work in a fast-paced, proactive collaborative environment.
Nice to Have:
- Direct experience supporting VA cybersecurity programs, RMF activities, or ATO processes.
- Experience with VA-specific GRC tools, ServiceNow Continuous Authorization and Monitoring (CAM), or other VA security tracking systems.
- Experience using ACAS, Nessus, HBSS, or comparable scanning and security monitoring tools.
- CISSP or CISM certification.
- Experience supporting ATOs for cloud-hosted or Software as a Service (SaaS) applications and familiarity with FedRAMP.
- Experience with cloud migration, cloud security architecture, or federal IT modernization initiatives.
- Familiarity with Agile/Scrum delivery and security integration into the software development lifecycle.
- Knowledge of VA healthcare applications, including VistA, or experience supporting complex federal healthcare IT environments.
What’s In It for You?
The opportunity to support high-visibility federal missions
A culture that values innovation, growth, and collaboration
Access to cutting-edge tools and technologies
Comprehensive benefits for you and your family
A career path that rewards ambition and performance
If you're ready to push boundaries, sharpen your skills, and join a team that is passionate about building what’s next, we’d love to meet you. Apply today and let’s build a future together!
LTS shares salary ranges to promote transparency. Compensation ranges are provided for informational purposes, and final compensation may vary based on experience, skills, location, and role requirements.
LTS is committed to offering eligible employees comprehensive benefits that will provide them with options intended to meet their needs and the needs of their family.
Similar Jobs
Aerospace • Information Technology • Professional Services • Security • Software
Investigates and responds to cybersecurity incidents, security alerts, suspicious activity, and threats across enterprise cloud, endpoint, identity, email, and collaboration environments. Uses Microsoft Defender, Purview, Sentinel, IDS, firewalls, and other monitoring tools for threat detection, incident response, risk assessment, compliance, and security operations. Maintains access controls, policies, procedures, and security requirements; conducts audits and investigations; recommends corrective actions; and improves detection and response capabilities.
Top Skills:
Cis ControlsCmmcData Lifecycle ManagementData Loss Prevention (Dlp)Endpoint ProtectionFedrampFirewallsIdentity Access Management (Iam)Information ProtectionInsider Risk ManagementIntrusion Detection Systems (Ids)Iso 27001Microsoft Defender For Cloud AppsMicrosoft Defender For EndpointMicrosoft Defender For IdentityMicrosoft Defender For Office 365Microsoft Defender XdrMicrosoft PurviewMicrosoft SentinelNetwork Traffic LogsNistRmfSecurity Information And Event Management (Siem)Security MonitoringSecurity Orchestration Automation And Response (Soar)Sensitivity Labels
Financial Services
Supports governance, risk, and compliance programs across Bertram Capital and its portfolio companies. Maintains NIST CSF profiles, policies, risk registers, control mappings, security baselines, and vendor due diligence processes. Coordinates SOC 2 readiness and audits, collects and validates evidence, tracks remediation, and manages recurring control activities. Communicates requirements to technical and business stakeholders, reports compliance status, and supports incident documentation and investor security questionnaires.
Top Skills:
Aicpa Trust Services CriteriaAWSAzureCis ControlsDrataGCPGoogle SheetsGoogle WorkspaceIso/Iec 27001JIRAMicrosoft 365ExcelMonday.ComNist Csf 2.0Nist Sp 800-53Soc 2Vanta
Other
Supports daily cybersecurity operations across cloud, identity, email, data, and endpoint environments. Monitors and investigates alerts, incidents, vulnerabilities, and suspicious activity; administers Microsoft security platforms; supports identity, email, cloud security, and access-control policies; coordinates remediation; maintains baselines, procedures, dashboards, and audit evidence; and contributes to incident response, risk assessments, control testing, and security improvements.
Top Skills:
Active DirectoryAzure PolicyCis BenchmarksCis ControlsConditional AccessDefender For CloudHipaaHitrustIso 27001/27002KerberosKqlmacOSMfaAzureMicrosoft DefenderMicrosoft Entra IdMicrosoft PurviewMicrosoft Security BaselinesMicrosoft SentinelNetskopeNist CsfOauthPrivileged Identity Management (Pim)ProofpointSAMLSoc 2Tenable Cloud SecurityWindows
What you need to know about the NYC Tech Scene
As the undisputed financial capital of the world, New York City is an epicenter of startup funding activity. The city has a thriving fintech scene and is a major player in verticals ranging from AI to biotech, cybersecurity and digital media. It also has universities like NYU, Columbia and Cornell Tech attracting students and researchers from across the globe, providing the ecosystem with a constant influx of world-class talent. And its East Coast location and three international airports make it a perfect spot for European companies establishing a foothold in the United States.
Key Facts About NYC Tech
- Number of Tech Workers: 549,200; 6% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Capgemini, Bloomberg, IBM, Spotify
- Key Industries: Artificial intelligence, Fintech
- Funding Landscape: $25.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Greycroft, Thrive Capital, Union Square Ventures, FirstMark Capital, Tiger Global Management, Tribeca Venture Partners, Insight Partners, Two Sigma Ventures
- Research Centers and Universities: Columbia University, New York University, Fordham University, CUNY, AI Now Institute, Flatiron Institute, C.N. Yang Institute for Theoretical Physics, NASA Space Radiation Laboratory
