Cybersecurity Analyst | On-site | Santa Rita, Guam | Top Secret Clearance

The Cybersecurity Analyst will provide hands-on cybersecurity support across NAVFAC Marianas Facility-Related Control Systems (FRCS) environments, helping protect the confidentiality, integrity, and availability of systems, networks, and data. The role supports the planning, implementation, documentation, maintenance, and improvement of cybersecurity programs, policies, procedures, and tools.

This position works closely with system owners, independent validators, the Information Systems Security Manager (ISSM), NAVFAC CIO personnel, and other government stakeholders. The analyst will also support cybersecurity incident response as a member of the MAR Cyber Emergency Response Team (CERT), participate in on-call rotations, and independently drive RMF and cybersecurity activities with minimal supervision.

The successful candidate will manage the full Risk Management Framework (RMF) lifecycle, Steps 1–6, in accordance with Department of the Navy and NAVFAC Echelon II guidance. The candidate will be capable of independently driving cybersecurity and RMF activities with minimal supervision, supporting systems throughout the full RMF lifecycle, maintaining Authorities to Operate (ATOs), conducting vulnerability and compliance assessments, and providing continuous monitoring and incident response support.

Essential Duties & Responsibilities:

• Execute the end-to-end RMF lifecycle (Steps 1–6) and ensure required artifacts meet DoN and NAVFAC requirements and are properly uploaded and maintained within eMASS.
• Support the attainment, maintenance, and tracking of Authorities to Operate (ATOs) for Facility-Related Control Systems.
• Facilitate annual security reviews and develop Memorandums for Record associated withsystem baseline changes.
• Develop and maintain cybersecurity policies, Standard Operating Procedures (SOPs), and implementation plans aligned with NIST SP 800-53 security control families and NAVFAC/DoN cybersecurity requirements.
• Develop and execute a comprehensive vulnerability management strategy.
• Perform vulnerability and compliance assessments using approved tools such as ACAS, SCAP, and Evaluate STIG.
• Perform manual STIG and Security Requirements Guide (SRG) validations and maintain required checklists.
• Generate Security Center and eMASSter reports and ensure vulnerability results are accurately maintained in the Vulnerability Remediation Asset Management (VRAM) database.
• Conduct System-Level Continuous Monitoring (SLCM), including recurring vulnerability scanning, security control reviews, audit log analysis, vulnerability remediation/mitigation, and quarterly Plan of Action and Milestones (POA&M) updates.
• Provide on-site validation and technical testing support for RMF Step 4 activities.
• Coordinate with system owners and independent validators during site assessments and technical evidence collection.
• Serve as a technical representative and/or Configuration Management Officer on the Configuration Control Board (CCB) and provide security impact analyses and risk assessments for proposed FRCS changes.
• Support cybersecurity incident response operations as a member of the MAR Cyber Emergency Response Team (CERT) and participate in required on-call rotations.
• Prepare incident response reports and operational documentation following cybersecurity events.
• Provide bi-weekly RMF status reporting to the ISSM and maintain FRCS RMF project records in Maximo and/or eProjects.
• Prepare recurring project, cybersecurity, continuous monitoring, and ATO milestone reporting in support of NAVFAC CIO priorities.