Security Analyst

Synergy Business Innovation & Solutions is a premier implementer of cutting-edge software solutions. Synergy brings the experience and expertise necessary to deliver capability that provides tangible ROI to our customers. Synergy’s core areas of expertise are in the fields of Digital Transformation, Cloud Solutions, SaaS and Low-Code/No-Code solutions, Emerging Technologies, Data analytics and Visualization, Information Assurance, and Business Process Re-Engineering.

Synergy offers its employees a generous portfolio of core and voluntary benefits including group medical, dental, and vision insurance, HSA, FSA, 401(k) with immediately vested company match, PTO, sick leave, 11 paid federal holidays, company paid life, short-term and long-term disability insurance, tuition and training reimbursement, fitness/wellness reimbursement, a referral bonus program, and life management programs.

At Synergy, you’ll be challenged and given the opportunity to grow in your career path. In fact, growth is such a big deal to us that you will have dedicated career coaches available for every employee, company-funded certification opportunities, education reimbursement, and a general open-door policy so that you have support when you need it. Our team is eager to learn, fast-paced, and quality-driven—if that sounds like you, Synergy has a position for you!

This position is designated as work-from-home.

We are seeking a mid-level Security Analyst. The candidate will work for the engineering division that supports developing and managing a suite of enterprise services and applications. As a member of the DevSecOps team, the candidate will focus on integrating security requirements with automated testing, code integration, and deployment processes and procedures. The candidate will work closely with our Development, DevOps, Support, and Administrative teams in an agile environment to manage a backlog of requirements, epics, stories and roadmaps for delivery.

Responsibilities

• Execution of Risk Management Framework
• Perform Security Impact Assessment for all application and environment updates
• Counsel to ensure auditing, testing, preventive and reactive measures are being adequately implemented for systems with an active Authorization to Operate (ATO).
• Coordinate between multiple teams to ensure user stories have accurate and specific acceptance criteria that support compliance and control requirements.
• Develop an in-depth understanding of customer requirements to quantify security and application risks, and perform impact assessments
• Identification, authoring, and monitor of necessary controls to achieve and maintain compliance
• Oversight, expertise, technical security strategy, standards, and best practices for security categorizations (low, moderate and high).
• Reviews, testing and implementation of security requirements within project plan timelines.
• Research and tracking of security standards, policies, and procedures.
• Support for multiple project assignments with strong and effective communication, time management and collaboration skills.

Qualifications:

• Documented experience executing Risk Management Framework (RMF, NIST-800-53)
• Control identification, definition, implementation, and monitoring
• Experience with agile software development
• General knowledge of security best practices and compliance requirements
• Knowledge of Risk Management Framework and other security and cyber security related frameworks
• Knowledge of NIST, FISMA, and other applicable guidance
• Excellent organizational and communication skills are mandatory for various stakeholder audiences
• Experience collaboratively establishing secure configuration baselines for technologies
• Knowledge or experience with conducting Assessment and Authorization (A&A) and Continuous Monitoring following NIST guidelines
• Knowledge or experience developing security documentation and conducting reviews for A&A packages
• Review and verify policies and procedures are developed in line with all applicable federal and LOC security standards and regulations
• Maintain, track, and communicate detailed project tasks
• Manage initial and reauthorization System Assessment and Authorization (SAA)/ Security Controls Assessment (SCA) task and milestone, task dependencies for low, moderate, and high security systems
• Develop and update security documentation including but not limited to:
• Privacy Threshold Assessment (PTA)/ Privacy Impact Analysis (PIA)
• Business Impact Assessment (BIA)
• Contingency Plans (CP)
• Configuration Management Plan (CMP)
• Change Management Plans, Incident Response Plans (IRP)
• Plan of Action and Milestones (POA&Ms)
• Security Assessment Reports (SAR)
• Memorandum of Understanding / Interconnection Security Agreement (ISA)
• Categorize and determine baseline IT security requirements in accordance with FIPS 199
• Identify and visually demonstrate system boundaries, select security controls, and ensure implemented controls are adequate for COTS or proprietary web applications. Provide recommendations as necessary to meet or improve controls
• Ensure security policies are developed, maintained and updated to meet IT security best business practices and standards, including Federal Info Security Management Act (FISMA), and National Institute of Standards and Technology (NIST) 800-53 – IPS federal info processing standard
• Be able to review security scans, advise on triaging vulnerabilities, and be able to provide recommendations on mitigating security risks
• Assist with testing and training functional teams, and advise them on providing security implementation evidence as necessary
• Assists with documenting and managing artifacts in Atlassian Suite (JIRA, Confluence) and CSAM security repositories, including but not limited to writing implementation statements
• Assists Information Systems Security Managers (ISSMs) in generating ATO packages
• Conduct continuous monitoring and reporting of security control implementations
• Must evaluate business strategies and requirements to develop security strategies, assess risk, research standards, and determine security requirements as necessary
• Track and coordinate POA&M remediation activity with different functional teams across multiple systems
• Experience with security tools such as (but not limited to) SIEMs and Static Code Analyzers
• Other duties as assigned
• Must have active certification in at least one of the following:
• CAP
• CASP CE
• CISM
• CISSP
• GSLC
• Ability to attain Federal Government Position of Trust
• Must be a U.S. citizen or foreign citizen authorized to legally work in the United States
• Must pass a background investigation

Preferred Qualifications:

• Experience in an enterprise security role
• Experience in DevSecOps
• Familiarity with FISCAM Audit Process and FIAR Compliance
• Proficient in the Atlassian suite of agile tools: Confluence and Jira
• Working with BPM (Business Process Management) application
• Working with API services
• Experience with security tools such as STIG Viewer and vulnerability scanners
• Experience with Java and other programming languages
• Experience with Federal Government systems
• Bachelor’s degree in Business/Computer Information Systems, Computer Science or related field.

LCAT: Computer Security System Specialist - Level II

Essential Job Function Physical Requirements: The physical requirements of this position are critical in evaluating the qualifications and abilities of an applicant or employee. The physical efforts needed to perform the essential duties of this job 90% of the time are repetitive motions, grasping, holding, and finger dexterity of the hands, reading, writing, eye-hand coordination, color distinction, and full visual abilities, hearing, talking, sitting, and use of IT equipment, phones, and office machines.

To a reduced degree, <30% of the time, candidates may have to stand, walk, lift 0-30 pounds, push or pull objects, climb stairs, bend, squat, reach, drive a car, or work overtime.

Synergy prefers that all new employees be fully vaccinated against COVID-19 before their start date.

Synergy is an equal opportunity employer, and does not discriminate against applicants for employment or its employees on the basis of age, race, creed, color, religion, ancestry, national origin, sexual orientation, gender identity or expression, military status, sex, medical condition, pregnancy, physical or mental disability, personal appearance, predisposing genetic characteristics, family responsibilities, familial status, marital status, status as a victim of domestic violence, political affiliation, arrest records and criminal convictions, or any other characteristic protected by law. Discrimination or harassment based upon these protected categories is expressly prohibited.