Cybersecurity Analyst
TIAG · Bethesda, MD 20814 ·
- Category
- Security
TIAG is hiring a Cybersecurity Analyst on-site in Bethesda, MD to modernize Authorization to Operate (ATO) packages for Google Cloud, Google Workspace, and ServiceNow GCC-High platforms supporting USUHS. The role spans the full RMF lifecycle — moving systems from NIST 800-53 Rev 3 to Rev 5 / DoD IL-4 baselines, writing SSPs, SARs, and POA&Ms in eMASS and ServiceNow GRC.
TIAG is hiring Cyber Security Analyst to support our team at the Uniform Services University of Health Sciences (USUHS) in Bethesda, MD. The Cyber Analyst will support the modernization of the Authorization to Operate (ATO) packages for enterprise platforms, specifically targeting Google Cloud, Google Workspace, and ServiceNow GCC-High instances.
This role focuses on transitioning system environments from legacy NIST SP 800-53 Revision 3 documentation and existing DISA eMASS baselines to completely modernized, organizationally tailored NIST SP 800-53 Revision 5 and DoD Impact Level 4 (IL-4) authorization packages.
Key Responsibilities
- Provide comprehensive support across the full RMF lifecycle, driving the ATO modernization process from initial gap analysis through final package validation and closeout recommendations.
- Create and modernize complete RMF authorization packages, which must include the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and Continuous Monitoring Plan.
- Draft and refine implementation-specific control narratives (answering controls) to ensure they accurately reflect the system's actual configuration, directly replacing generic baseline statements.
- Develop, document, and manage POA&Ms for any control gaps identified during technical discovery that require future remediation.
- Prepare all required fields, supporting documentation, artifacts, and attachments to support eMASS readiness and Government upload.
- Upload and map artifacts, technical evidence, control responsibilities, and POA&M information to individual Control Objectives within the ServiceNow GRC Policy and Compliance module.
- Evaluate Cloud Service Provider FedRAMP packages to determine control inheritance, tailoring the baseline to reflect local Agency implementation, shared responsibilities, and DoD IL-4 requirements.
- Perform 100% Human-in-the-Loop (HitL) validation on all AI-assisted technical content to ensure narratives accurately address Rev 5 controls and contain no unsupported technical statements.
- Document organizational tuning decisions in coordination with system stakeholders, capturing risk acceptances, organizational overrides, compensatory mitigations, and tool-specific authorizations.