Sr. Cyber Security Analyst IV - South Dakota

Senior Cybersecurity Analyst / RMF Lead / Enterprise Compliance Support

Position Overview

The Sr Cyber Security Analyst IV serves as a senior cybersecurity engineer and RMF lead supporting all systems within the DAF Financial Management AO boundary. The position provides expert advisory support to the FM AO, AODR, Program Offices, system owners, and engineering teams; translates Federal, DoD, and Air Force cybersecurity policy into actionable implementation guidance; leads authorization lifecycle activities; and delivers risk-informed decision support for enterprise FM systems.

Essential Duties & Responsibilities

• Lead and support the full RMF lifecycle, including security control selection, implementation, validation, continuous monitoring, authorization, and authorization sustainment across multiple FM systems.
• Provide expert advisory support to the FM AO, AODR, and Program Offices regarding compliant application of Federal, DoD, and Air Force cybersecurity policy; translate policy into actionable enterprise implementation guidance.
• Develop, manage, quality-review, and sustain authorization artifacts including SSPs, RARs, POA&Ms, control evidence, assessment artifacts, and continuous-monitoring documentation in eMASS and ITIPS.
• Conduct vulnerability assessments, perform risk analysis, design mitigation strategies, and coordinate remediation with system owners and PMOs across the FM portfolio.
• Track, analyze, and report enterprise-wide vulnerability trends, remediation status, POA&M closure rates, overdue items, and systemic risks to FM leadership.
• Generate comprehensive A&A decision staffing packages with risk analysis, control summaries, mission impact, and formal recommendations supporting ATO, ATO with Conditions, or Denial decisions.
• Prepare AO decision-support materials and Mission Impact Assessments and brief the AO, FM leadership, working groups, and governance forums.
• Lead or support security control assessments and produce findings reports identifying gaps, weaknesses, risk levels, and recommended remediation strategies.
• Maintain or oversee FM systems inventory and boundary documentation, authorization status, key contacts, and ATO expiration data.
• Draft or update FM-level cybersecurity policies, SOPs, templates, checklists, guidance, and compliance documentation for Government review.
• Support configuration baseline integrity, patch/vulnerability remediation, and implementation tracking for IAVAs, TCNOs, and related security directives.
• Coordinate cybersecurity requirements with infrastructure, database, systems administration, configuration-management, and development/test functions and validate security impacts of system changes.
• Analyze security events, audit data, vulnerability information, and suspicious activity; support incident analysis, reporting, escalation, and Government investigations.
• Prepare annual cybersecurity program reviews, leadership briefings, status reports, metrics, strategic recommendations, and Section 508-compliant deliverables.

Required Technical Competencies

• Advanced RMF/A&A lifecycle leadership, NIST SP 800-53, DoDI 8510.01, Air Force cybersecurity policy, and DISA STIG implementation/validation.
• Advanced eMASS and ITIPS authorization-package management.
• Enterprise vulnerability and risk management, mitigation strategy development, POA&M governance, and continuous monitoring.
• Risk-informed AO decision support, Mission Impact Assessments, security control assessment findings, and executive briefings.
• Working knowledge of Windows/Linux, Active Directory, DB2, IBM WebSphere, Nutanix-based infrastructure, and cross-domain cybersecurity dependencies relevant to FMWF.

Preferred Experience

• Air Force enterprise cybersecurity and Financial Management systems.
• AFFSO, SAF/FM, AFIMSC, FM AO/AODR, or comparable DoD authorization environments.
• Leadership of multi-system RMF portfolios, authorization decisions, enterprise compliance reporting, and cybersecurity governance forums.

Security, Access & Contract Compliance Requirements

• Obtain and maintain the Government-required suitability, access, and security determinations applicable to assigned duties and comply with the DD254 and local installation requirements.
• Maintain the minimum NACI/Entrance NACI required for personnel using unclassified Government Automated Information Systems (AIS), including email. Personnel with root access to operate, modify, or maintain a Government system must meet the trustworthiness/background-investigation requirement specified by the PWS/DD254.
• Complete Air Force-mandated Information Assurance Awareness Training before access to Government computing resources and maintain required DD Form 2875 System Authorization Access Request documentation.
• Obtain and properly display required CAC, Restricted Area Badge, contractor identification, and other installation credentials as applicable.
• Immediately report known or suspected security violations or incidents and assist Government security-related inquiries or investigations as directed.
• Protect Personally Identifiable Information (PII) in accordance with NIST SP 800-122 and comply with the Privacy Act, applicable Air Force security directives, Government-resource restrictions, and consent-to-monitoring requirements.
• Complete the required Contractor Employee Non-Disclosure Agreement and use Government-furnished systems and resources for authorized official business only.

Equal Employment Opportunity

We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable law. We are committed to fostering a diverse, inclusive, and welcoming workplace.