Supports federal cybersecurity risk management and authorization activities, including ATO packages, NIST RMF implementation, security control assessments, vulnerability remediation, POA&M tracking, continuous monitoring, audit readiness, privacy documentation, and incident or contingency planning. Coordinates with ISSOs, engineers, system owners, project managers, and VA stakeholders while maintaining compliance records in ServiceNow and GRC tools.
Clearance: Ability to obtain and maintain a Public Trust
Salary Range: 80K-90K
LTS is seeking an experienced Cybersecurity Analyst to support cybersecurity, risk management, and security authorization activities across multiple projects within the U.S. Department of Veterans Affairs (VA) Health portfolio.
The analyst will provide hands-on support for the Risk Management Framework (RMF), Authority to Operate (ATO) processes, security control assessments, vulnerability remediation, continuous monitoring, and security and privacy documentation. This role requires independent execution of assigned deliverables and close coordination with Information System Security Officers (ISSOs), technical teams, project managers, and VA stakeholders.
The Health PMO support contract provides IT program management, project management, technical management, financial management, functional planning, and documentation analysis in support of the Enterprise Program Management Office (EPMO) Enterprise Program Management Division (EPMD) Health Portfolio
The VA Health Portfolio is focused on development and execution of quality IT projects that address the needs of Veterans and health care providers through management of healthcare information and sustainment of production software to keep the mission going.
What You’ll Do:
- Support development, maintenance, and updates of ATO packages, security authorization artifacts, and related documentation.
- Apply NIST RMF, NIST SP 800-53 Revision 5, VA Handbook 6500, and applicable federal and VA cybersecurity requirements to assigned systems and projects.
- Review and document security controls; support security control assessments, authorization activities, and continuous monitoring.
- Coordinate with ISSOs, system owners, engineers, and project stakeholders to identify security risks and address authorization requirements.
- Develop, evaluate, maintain, and track Plans of Action and Milestones (POA&Ms) from identification through documented closure.
- Review vulnerability scan results, analyze findings, coordinate corrective actions, and track remediation status.
- Support system scanning, audit readiness, High Value Asset (HVA) reviews, and other mandated security assessments.
- Prepare and maintain security and privacy artifacts, compliance reports, standard operating procedures, and supporting program documentation.
- Assist with contingency planning, incident response and disaster recovery documentation, and related exercises or testing.
- Support Privacy Impact Assessments (PIAs), Privacy Threshold Analyses (PTAs), and other applicable privacy documentation.
- Maintain accurate records and status updates in ServiceNow, governance, risk, and compliance (GRC) platforms, and other authorized tracking tools.
- Work with application development, operations, security architecture, and engineering teams to integrate security requirements throughout the system development lifecycle.
- Support security activities for IT modernization, application maintenance, cloud-related initiatives, and Agile delivery teams.
- Communicate security risks, remediation priorities, deliverable status, and process improvement recommendations to program and government stakeholders.
- Manage multiple assignments and deadlines independently while collaborating effectively in a remote team environment.
What We’re Looking For:
- Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Information Technology, or a related field, plus at least five years of relevant professional experience; an additional five years of relevant experience may substitute for the degree.
- At least five years of relevant cybersecurity, information assurance, or federal security compliance experience.
- Hands-on experience supporting ATO processes for systems or applications at the VA or another federal agency.
- Practical experience applying NIST RMF, including security control documentation, assessment, authorization, and continuous monitoring.
- Strong working knowledge of FISMA, NIST SP 800-53, and applicable federal cybersecurity requirements; familiarity with HIPAA and HITECH requirements in healthcare environments.
- Experience developing and maintaining security authorization packages, assessment evidence, and compliance artifacts.
- Demonstrated experience creating, evaluating, tracking, and closing POA&Ms, including coordination of remediation actions.
- Experience analyzing vulnerability findings, coordinating mitigation, and tracking issues through resolution.
- Experience using enterprise GRC or security compliance tracking tools and a ticketing or workflow platform such as ServiceNow.
- Experience supporting security control assessments, cybersecurity audits, or compliance reviews.
- Strong analytical, technical writing, communication, and stakeholder coordination skills; ability to perform hands-on work independently in a collaborative remote environment.
- Current CompTIA Security+, GIAC GSEC, ISC2 CISSP, ISACA CISM, or another cybersecurity certification approved for the position.
- Ability to work in a fast-paced, proactive collaborative environment.
Nice to Have:
- Direct experience supporting VA cybersecurity programs, RMF activities, or ATO processes.
- Experience with VA-specific GRC tools, ServiceNow Continuous Authorization and Monitoring (CAM), or other VA security tracking systems.
- Experience using ACAS, Nessus, HBSS, or comparable scanning and security monitoring tools.
- CISSP or CISM certification.
- Experience supporting ATOs for cloud-hosted or Software as a Service (SaaS) applications and familiarity with FedRAMP.
- Experience with cloud migration, cloud security architecture, or federal IT modernization initiatives.
- Familiarity with Agile/Scrum delivery and security integration into the software development lifecycle.
- Knowledge of VA healthcare applications, including VistA, or experience supporting complex federal healthcare IT environments.
What’s In It for You?
The opportunity to support high-visibility federal missions
A culture that values innovation, growth, and collaboration
Access to cutting-edge tools and technologies
Comprehensive benefits for you and your family
A career path that rewards ambition and performance
If you're ready to push boundaries, sharpen your skills, and join a team that is passionate about building what’s next, we’d love to meet you. Apply today and let’s build a future together!
LTS shares salary ranges to promote transparency. Compensation ranges are provided for informational purposes, and final compensation may vary based on experience, skills, location, and role requirements.
LTS is committed to offering eligible employees comprehensive benefits that will provide them with options intended to meet their needs and the needs of their family.
Similar Jobs
Security • Cybersecurity
Performs incident management and second-level SOC operations, including investigating security anomalies, responding to escalated incidents, analyzing logs and network traffic, and conducting breach investigations. Designs security controls, improves incident response processes, manages SIEM capabilities, creates detection playbooks and automations, maintains documentation, and supports threat hunting using KQL across Azure and Microsoft 365 environments. Provides infrequent off-hours support and may travel up to 10%.
Top Skills:
KqlLinuxMicrosoft 365AzureMicrosoft SentinelMitre Att&CkNistPowershellPythonSIEMWindows
Aerospace • Information Technology • Professional Services • Security • Software
Investigates and responds to cybersecurity incidents, security alerts, suspicious activity, and threats across enterprise cloud, endpoint, identity, email, and collaboration environments. Uses Microsoft Defender, Purview, Sentinel, IDS, firewalls, and other monitoring tools for threat detection, incident response, risk assessment, compliance, and security operations. Maintains access controls, policies, procedures, and security requirements; conducts audits and investigations; recommends corrective actions; and improves detection and response capabilities.
Top Skills:
Cis ControlsCmmcData Lifecycle ManagementData Loss Prevention (Dlp)Endpoint ProtectionFedrampFirewallsIdentity Access Management (Iam)Information ProtectionInsider Risk ManagementIntrusion Detection Systems (Ids)Iso 27001Microsoft Defender For Cloud AppsMicrosoft Defender For EndpointMicrosoft Defender For IdentityMicrosoft Defender For Office 365Microsoft Defender XdrMicrosoft PurviewMicrosoft SentinelNetwork Traffic LogsNistRmfSecurity Information And Event Management (Siem)Security MonitoringSecurity Orchestration Automation And Response (Soar)Sensitivity Labels
Financial Services
Supports governance, risk, and compliance programs across Bertram Capital and its portfolio companies. Maintains NIST CSF profiles, policies, risk registers, control mappings, security baselines, and vendor due diligence processes. Coordinates SOC 2 readiness and audits, collects and validates evidence, tracks remediation, and manages recurring control activities. Communicates requirements to technical and business stakeholders, reports compliance status, and supports incident documentation and investor security questionnaires.
Top Skills:
Aicpa Trust Services CriteriaAWSAzureCis ControlsDrataGCPGoogle SheetsGoogle WorkspaceIso/Iec 27001JIRAMicrosoft 365ExcelMonday.ComNist Csf 2.0Nist Sp 800-53Soc 2Vanta
What you need to know about the Colorado Tech Scene
With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.
Key Facts About Colorado Tech
- Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
- Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
- Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
- Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
- Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute
