Information Security Analyst
Rockville, MD / Tyson, VA Hybrid 3 days onsite
12+ Months Contract
CISSP + FedRAMP (big big plus)
This is a GRC (Governance, Risk, Compliance) Security Consultant role focused on:
- FedRAMP / FISMA compliance
- Translating NIST SP 800-53 controls into real systems
- Building and maintaining ATO (Authority to Operate) packages
- Acting as a client-facing advisor (not just technical—this is consultative)
Think: “bridge between cybersecurity, compliance, and business stakeholders”
Ideal Candidate Profile (What actually works in the market)
Core Background
- 3–5 years in:
- Cybersecurity (GRC, Risk, Compliance)
- Or Federal consulting (Deloitte, Booz, Guidehouse, etc.)
- Experience with:
- FedRAMP
- FISMA
- NIST frameworks (especially 800-53)
Must-Have Skill Set
- Writing System Security Plans (SSPs) end-to-end
- Understanding RMF (Risk Management Framework) via NIST SP 800-37
- Experience supporting or maintaining ATO lifecycle
- Reviewing vulnerability scans (Qualys, Burp, etc.)
- Strong client-facing communication
Certifications (what actually closes candidates)
Best combos:
- Security+ (baseline)
-
- CAP or CISSP (huge boost)
-
- AWS (if cloud/FedRAMP-heavy client)
? If they have CISSP + FedRAMP = premium candidate ($$$)
? What They’ll Actually Do Day-to-Day
This helps you screen fast:
- Write/edit SSPs, IR Plans, Contingency Plans
- Map system controls ? NIST 800-53 controls
- Sit in calls with clients extracting system info
- Review scan results + flag risks
- Help prepare for audits / ATO renewals
- Keep documentation updated (this is BIG)
60% documentation + 25% client interaction + 15% technical review
What to Watch Out For (Common Mismatches)
Avoid candidates who:
- Are purely SOC / blue team (they won’t like documentation-heavy work)
- Only did penetration testing with no compliance exposure
- Don’t understand ATO lifecycle
- Have zero federal exposure
Never miss an opportunity! Create an alert based on the job you applied for.
