System Security Analyst

Position Overview
The Systems Security Analyst / Information Systems Security Engineer (ISSE) provides cybersecurity engineering support to the Naval Facilities Engineering Systems Command (NAVFAC) Marianas Command Information Office (CIO). The role focuses on protecting the confidentiality, integrity, and availability of Facility-Related Control Systems (FRCS), networks, and data through the full Risk Management Framework (RMF) lifecycle, vulnerability management, continuous monitoring, policy development, and incident response.Personnel are considered Emergency Essential / Mission Essential and may be required to support the MAR Cyber Emergency Response Team (CERT) on-call rotation (with schedule flexing to stay within 40 hours/week).

Key Responsibilities

• Drive end-to-end RMF lifecycle execution (Steps 1–6) in accordance with Department of the Navy (DoN) and NAVFAC Echelon II guidance; verify system inventories and artifacts for compliance, completeness, and quality; format and upload packages into eMASS.
• Achieve, maintain, and track Authorities to Operate (ATOs) for FRCS; facilitate annual security reviews and draft/submit Memorandums for Record (MFRs) for baseline changes.
• Develop, author, and maintain security policies, Standard Operating Procedures (SOPs), and implementation plans mapped to NIST SP 800-53 control families, tailored to the FRCS environment.
• Develop and execute a comprehensive Vulnerability Management Strategy; perform vulnerability and compliance assessments using approved DoN tools (ACAS, SCAP, Evaluate STIG); complete manual STIG/SRG validations (.ckl/.cklb); generate Security Center and eMASSter reports; upload results to VRAM.
• Sustain System-Level Continuous Monitoring (SLCM): conduct routine scans, audit log analysis, drive remediation/mitigation, and provide accurate quarterly Plan of Action and Milestones (POA&M) updates.
• Deliver on-site validation and testing support for RMF Step 4, coordinating with system owners and independent validators.
• Serve as technical representative / Configuration Management (CM) Officer on the Configuration Control Board (CCB); provide security impact analyses and risk assessments for proposed FRCS baseline changes.
• Execute incident response operations as a member of the MAR CERT, including participation in on-call rotations.
• Prioritize and coordinate technical support across FRCS environments; deliver bi-weekly RMF status reports to the ISSM and maintain project status records in Maximo and/or eProjects; prepare Monthly Status Reports (MSRs).

Required Qualifications

• U.S. Citizenship.
• Active Top Secret security clearance.
• DoDM 8140.03 foundational qualification for Work Role 461 (Systems Security Analyst) at Intermediate (or Advanced) proficiency level.
  • Intermediate-level certifications (one required): CCSP, Cloud+, GICSP, GISF, GSEC, or Security+.
  • Advanced-level certifications also accepted (e.g., CISSP, CySA+, etc.).
• Minimum of 5 years of RMF experience and 1 year of specialized experience with Facility-Related Control Systems (FRCS) performing RMF and cybersecurity engineering tasks (strongly preferred).
• Demonstrated ability to work independently with minimal supervision.
• Excellent written and verbal communication skills in English; proven ability to author technical reports, security policies, and procedures and interface effectively with system owners, ISSMs, and other government personnel.
• Physical capability to perform the duties, including prolonged standing/walking over uneven surfaces, bending, climbing ladders, and lifting IT equipment up to 25 lbs.
• Maintain certification currency and complete required Continuous Professional Development (CPD) hours annually.

Preferred / Highly Desired

• Prior experience supporting NAVFAC, DoN, or DoD FRCS environments.
• Hands-on experience with eMASS, ACAS/Nessus, VRAM, Security Center, STIG Viewer, and Maximo/eProjects.
• Familiarity with NAVFAC Echelon II RMF Business Rules.