APV · 3 weeks ago
Senior Security Analyst/ISSO
United States
Full-time
Remote
Senior Level
8+ years expAPV is a mission-driven company transforming organizations through advanced technology and human ingenuity. The Senior Security Analyst/Information Systems Security Officer (ISSO) will provide advanced cybersecurity and risk management support to the Department of Homeland Security, leading ATO cycles and incident response coordination.
Software
No H1B
Security Clearance RequiredU.S. Citizen Only
Responsibilities
Independently lead Authorization to Operate (ATO) and reauthorization cycles for assigned IT systems, including security control assessment coordination, residual risk analysis, AO briefings, and ongoing authorization decisions
Apply the DHS 4300A Sensitive Systems Policy, the DHS 4300A Sensitive Systems Handbook, the NIST Risk Management Framework (NIST SP 800-37), and NIST SP 800-53 controls across the HC system lifecycle
Draft and maintain Security Authorization Package (SAP) artifacts, including the System Security Plan (SSP), Security Assessment Plan, Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), Contingency Plan, and Incident Response Plan
Apply FIPS 199 and FIPS 200 categorization to HC systems and tailor NIST SP 800-53 baselines (typically Moderate or High) accordingly
Coordinate Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA) inputs with the DHS Privacy Office, including SORN updates for HR systems of records
Lead the DHS Information Security Continuous Monitoring (ISCM) program for assigned systems, including vulnerability identification, risk-based prioritization, and remediation tracking through POA&M closure
Operate and analyze SIEM platforms (Splunk, AWS Security Hub, Microsoft Sentinel, or comparable), vulnerability scanners (Nessus, Qualys, or comparable), and endpoint protection tooling
Lead Continuous Diagnostics and Mitigation (CDM) integration, asset and vulnerability dashboards, and risk reporting in alignment with DHS CDM program requirements
Conduct security assessments, audits, and control testing on assigned HC systems
Lead risk-based decision support for the AO, including documented risk acceptance, mitigation, transfer, and avoidance recommendations
Lead security workstreams, including security architecture reviews of integration interfaces, cloud security posture management for AWS GovCloud and Azure Government environments, and ATO planning for the modernized target-state HC platform
Advise integration teams on security best practices for REST/SOAP APIs, SFTP file transfers, ETL/ELT pipelines, and iPaaS-based integrations involving HR data
Apply NIST SP 800-218 Secure Software Development Framework (SSDF), DevSecOps pipeline security, and software supply chain risk management principles to HC modernization activities
Apply FIPS 140-2 / 140-3 cryptographic standards, federal identity and access management standards, and DHS boundary protection requirements to HC system data flows
Support FedRAMP coordination for cloud-based HC services where applicable
Coordinate breach response for incidents involving employee PII, SPII, payroll, benefits, medical, or disability data with the DHS Privacy Office, OGC, and leadership
Support incident response activities, coordinating with the DHS Security Operations Center (SOC), CISA, and component cybersecurity teams to triage, contain, and remediate security incidents
Report incidents in accordance with US-CERT incident reporting guidelines and DHS reporting timelines
Lead post-incident analysis, lessons-learned documentation, and corrective action tracking
Maintain incident response readiness through tabletop exercises, playbook updates, and team coordination drills tailored to HC data scenarios
Serve as a senior consultative resource to DHS leadership, the System Owner, AO, ISSM, the DHS CISO, the DHS Privacy Office, OCIO, integration teams, and APV leadership
Mentor mid-level ISSO specialists; review their work products for technical quality, documentation rigor, and standards compliance
Draft and maintain SOPs, desk guides, control implementation guidance, and security training materials
Prepare executive-grade briefings, decision papers, status reports, and risk dashboards for DHS leadership
Build and maintain SharePoint-based knowledge repositories, ATO artifact libraries, and security knowledge bases
Qualification
Required
U.S. Citizenship
Active DHS Public Trust or favorably adjudicated investigation; ability to obtain and maintain required suitability/access throughout the period of performance. Some DHS task orders may require Secret or Top Secret clearance
Minimum 8-10 years of experience in cybersecurity, risk management, and compliance for federal IT systems, including significant time as an ISSO or comparable security lead
Demonstrated experience leading ATO and reauthorization cycles end-to-end, including SSP, SAR, POA&M, and Contingency Plan development
Working knowledge of FISMA, the NIST Risk Management Framework (NIST SP 800-37), NIST SP 800-53, FIPS 199/200, OMB A-130, the Privacy Act of 1974, and federal cybersecurity directives
Hands-on experience with SIEM tools (Splunk, AWS Security Hub, Microsoft Sentinel, or comparable), vulnerability scanning (Nessus, Qualys, or comparable), and endpoint protection
Experience with cloud security in AWS GovCloud and/or Microsoft Azure Government environments
Strong knowledge of DHS cybersecurity frameworks, including the DHS 4300A Sensitive Systems Policy and Trusted Internet Connections (TIC 3.0) requirements
Strong written and verbal communication skills, including the ability to brief senior stakeholders and produce defensible, audit-ready security documentation
Preferred
Prior experience supporting DHS, OPM, federal HR shared services, or other federal Human Capital cybersecurity programs
Experience supporting cybersecurity for federal HR systems, including NFC EmpowHR, USA Staffing, FedTalent, OPM eOPF, OPM Retirement Services Online, webTA, BENEFEDS, or TSP integrations
Experience supporting HC system migrations or modernization programs, including ATO planning for target-state platforms
Prior experience supporting DHS or DHS component cybersecurity programs
Experience supporting DHS CDM, TIC 3.0, and Federal Zero Trust Strategy implementation under OMB M-22-09
Certifications such as CISSP, CISM, CISA, CRISC, AWS Security Specialty, Azure Security Engineer Associate, or CompTIA CASP+
DoD 8570/8140 IAT Level III, IAM Level II/III, or IASAE Level II/III qualification
Experience with NIST SP 800-218 Secure Software Development Framework (SSDF) and DevSecOps pipeline security
Experience supporting Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA), and SORN activities with the DHS Privacy Office
Company
APV
At APV, we are a mission-driven powerhouse that transforms organizations through advanced technology and innovative IT solutions.
51-200 employees
Funding
Current Stage
Growth StageLeadership Team
Sudhakar Gududuri
CTO
Recent News
2026-05-05
EIN Presswire
2026-04-09
Company data provided by crunchbase