IT Security Analyst

BridgePhase is a mission-focused technology company that designs builds secures and operates modern digital solutions that drive national security government efficiency and mission success across the Federal Government. We empower agencies to achieve meaningful outcomes through high-performing software engineering cloud DevSecOps cybersecurity AI/ML and platform modernization solutions delivered by collaborative teams focused on innovation adaptability and operational excellence. As a trusted partner BridgePhase helps Federal organizations modernize critical systems accelerate delivery and achieve lasting mission impact.

Position Overview:

BridgePhase is seeking a detail-oriented self-driven IT Security Analyst to support cybersecurity operations vulnerability management and continuous compliance efforts within a FedRAMP-authorized cloud environment. This individual will work closely with cybersecurity cloud operations and technical teams to maintain security documentation assess system vulnerabilities support risk management activities and ensure enterprise systems remain aligned with Federal security requirements and established compliance frameworks.

The ideal candidate brings a strong understanding of Federal cybersecurity standards risk management frameworks and cloud security practices along with hands-on experience in vulnerability assessment security documentation and remediation coordination. This role requires a proactive problem solver who can analyze complex technical environments identify and prioritize security risks collaborate across technical teams and support the ongoing security and compliance of mission-critical enterprise systems.

This position requires candidates to be U.S. citizens who hold no additional citizenship. This is a hybrid role requiring onsite work in Herndon VA three days per week (Tuesday Wednesday and Thursday) with the potential to increase to five days per week based on business needs.

Key Responsibilities:

• Support cybersecurity operations and continuous compliance monitoring for enterprise cloud environments ensuring alignment with FedRAMP NIST DoD and other applicable Federal security requirements.
• Develop update and maintain security documentation compliance artifacts policies procedures and authorization packages required to support ongoing system security and accreditation activities.
• Maintain and support Plans of Action and Milestones (POA&Ms) tracking identified security weaknesses remediation activities and compliance milestones through resolution.
• Collaborate with Cloud Operations and technical teams to identify assess prioritize and remediate system vulnerabilities across cloud infrastructure applications and containerized environments.
• Conduct vulnerability assessments and analyze potential attack vectors to determine exploitability assess risk and recommend appropriate remediation strategies.
• Support the implementation of risk-based vulnerability management processes prioritizing remediation efforts based on system exposure security impact and Federal compliance requirements.
• Develop and maintain automation scripts using Python Bash PowerShell or similar technologies to streamline vulnerability identification analysis reporting and remediation workflows.
• Analyze container security vulnerabilities using approved scanning tools identifying operating system and application-level risks and coordinating corrective actions.
• Support security assessments of CI/CD pipelines container registries AWS Elastic Container Registry (ECR) and container image management processes.
• Assist with security authorization and accreditation activities including Risk Management Framework (RMF) assessments system categorization security control evaluations and authorization to operate (ATO) documentation.
• Evaluate security control implementation and inheritance across cloud environments ensuring compliance with applicable FedRAMP NIST and organizational security requirements.
• Review and interpret system architecture documentation network diagrams connectivity models and data flow diagrams to assess security posture and identify potential risks.
• Apply Federal security frameworks and guidance including FISMA NIST SP 800-series publications DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs).
• Support the development and implementation of security policies and procedures aligned with FedRAMP NIST SP 800-171 and applicable Defense Federal Acquisition Regulation Supplement (DFARS) requirements.
• Assess system security configurations patching processes vulnerability scanning mechanisms and compliance status across development testing staging and production environments.
• Provide technical guidance and risk-based recommendations to stakeholders regarding evolving Federal cybersecurity regulations cloud security requirements and organizational security policies.
• Collaborate with cybersecurity engineering cloud operations and compliance teams to investigate security findings resolve technical issues and continuously improve security processes.
• Prepare and present security assessments compliance updates vulnerability reports and risk mitigation recommendations to technical teams stakeholders and leadership.

Education & Experience Requirements:

• Bachelors degree in Computer Information Systems Cybersecurity Computer Science Mathematics or a related technical or scientific field.
• Experience supporting cybersecurity operations vulnerability management risk assessments or security compliance initiatives within enterprise or Federal environments.
• Strong understanding of Federal cybersecurity frameworks and requirements including FedRAMP FISMA NIST SP 800-series publications and the NIST Risk Management Framework (RMF).
• Knowledge of DoD security requirements including DISA STIGs Security Requirements Guides (SRGs) and applicable Committee on National Security Systems (CNSS) guidance.
• Experience developing maintaining or supporting system security documentation authorization packages Plans of Action and Milestones (POA&Ms) and security policies and procedures.
• Understanding of security authorization and accreditation processes including system categorization security control assessments risk analysis and authorization to operate (ATO) requirements.
• Experience identifying analyzing and prioritizing vulnerabilities based on exploitability system exposure and potential security impact.
• Hands-on experience with vulnerability scanning tools and techniques including container security scanning and remediation analysis.
• Experience developing or maintaining automation scripts using Python Bash PowerShell Java or similar programming languages.
• Knowledge of containerized environments CI/CD pipelines AWS Elastic Container Registry (ECR) and container image mirroring processes.
• Understanding of cloud security principles enterprise infrastructure operating systems networking technologies and application security controls.
• Ability to analyze technical architecture documentation network diagrams system connectivity and data flow diagrams using tools such as Microsoft Visio.
• Familiarity with SAP products and their associated security considerations within enterprise cloud environments.
• Knowledge of NIST SP 800-171 security requirements applicable DFARS clauses and Federal information security and privacy requirements including the Privacy Act.
• Experience supporting cybersecurity activities across development testing staging pre-production and production environments.
• Strong analytical and troubleshooting skills with the ability to assess complex technical environments identify security risks and recommend practical remediation strategies.
• Excellent written and verbal communication skills including the ability to develop clear technical documentation and present security findings to both technical and non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple priorities adapt to evolving security requirements and work effectively in a fast-paced team-oriented environment.
• Ability to work independently take ownership of assigned responsibilities and collaborate across cybersecurity engineering and cloud operations teams.
• Must be a U.S. citizen and hold only U.S. citizenship.

As with any dynamic technical environment responsibilities will evolve based on customer and mission needs. We are looking for individuals who are adaptable proactive and eager to take ownership of new challenges as they arise.

About Our Company:

BridgePhase was built around one simple belief: People who love where they work build better solutions. We bring top-tier engineering talent to the Government to support the nations most critical work. Our people are not only technically exceptional theyre energized to deliver the engineering excellence culture and accountability our Government deserves. We thrive on building modern secure resilient solutions that accelerate mission outcomes eliminate legacy barriers and enable Government organizations to deliver faster and adapt smarter to meet todays demands and tomorrows mission without compromise.

Our Benefits:

At BridgePhase we invest in our people with benefits that support your life reward your impact and reflect what matters most both on the job and beyond it. Employee benefits include:

• Competitive compensation that reflects your skills and impact
• Multiple bonus programs rewarding performance company growth and employee referrals
• Flexible PTO with 20 days to use when you need them
• All federal holidays paid to help you truly recharge
• 7 paid sick days because health always comes first
• 100% paid parental leave
• 401(k) with 6% match and no vesting period
• Top-tier medical dental and vision plans with low out-of-pocket costs
• Short- and long-term disability and life insurance included
• Pet insurance to support your four-legged family
• Annual professional development budget for training certifications and conferences
• Two paid community service days for causes that matter to you
• Social pod budget to connect with teammates wherever you live