Cybersecurity A&A Risk Analyst

Cherokee Federal

. Manage full lifecycle Risk Management Framework (RMF) activities in accordance with NIST SP 800-37 .

Posted 10/13/2026full-timeRemote • United StatesSeniorLead💰 $110,000 - $112,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing the Risk Management Framework (RMF) in compliance with NIST standards, including conducting risk assessments and developing security documentation. Proficient in engaging with stakeholders and providing governance support in federal cybersecurity initiatives.

Highest-signal resume keywords

Risk Management Framework (RMF) ImplementationNIST SP 800-37 ComplianceFedRAMP Authorization ExperienceCISSP CertificationPublic Trust Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

NIST SP 800-53 Rev. 5 Security ControlsRisk AssessmentSecurity Documentation DevelopmentVulnerability ScanningRegulatory Analysis

Soft Skills

Effective CommunicationStakeholder EngagementCollaboration with Technical Teams

Tools & Technologies

ServiceNowMicrosoft 365CSAMAtlassian ConfluenceJIRA

Certifications & Qualifications

CISSPCISMCAP

Industry Keywords

FISMAFederal Zero Trust StrategyFedRAMPCybersecurity PolicyGovernance Risk Compliance (GRC)

Tech Stack

Tools & technologies

CloudCyber SecurityServiceNow

About the role

Key responsibilities & impact

Manage full lifecycle Risk Management Framework (RMF) activities in accordance with NIST SP 800-37
Develop, review, and maintain SSPs, SAPs, SARs, and POA&Ms
Review and assess FedRAMP authorization packages and updates
Monitor ATO packages in the FedRAMP Secure Repository
Communicate with system owners, ISSOs, Cloud Service Providers, and security stakeholders regarding system changes and compliance
Evaluate and validate NIST SP 800-53 Rev. 5 security controls
Conduct NIST SP 800-30-aligned risk assessments and provide recommendations to Authorizing Officials and senior stakeholders
Support continuous monitoring and ongoing authorization by reviewing vulnerability scans, tracking POA&Ms, and coordinating remediation
Peer review cybersecurity policies, standards, procedures, and implementation guidance
Perform regulatory and policy analysis for federal requirements and agency directives
Conduct gap analyses and recommend remediation strategies
Assist with control overlays, baseline updates, and security control tailoring guidance
Provide subject matter expertise in governance discussions
Support enterprise reporting, risk metrics, and ServiceNow compliance dashboards
Support internal and external reviews, including FISMA reporting
Prepare responses to oversight inquiries and track corrective actions
Perform quality assurance reviews of security documentation
Perform other job-related duties as assigned

Requirements

What you’ll need

Bachelor’s degree in Cybersecurity, Information Technology, Public Policy, or related discipline (or equivalent experience)
Professional certification(s) such as CISSP, CISM, or CAP
Minimum of 7 years of progressive cybersecurity experience, including at least 4 years supporting federal RMF/A&A efforts
Demonstrated experience implementing the NIST Risk Management Framework
Knowledge of FISMA
Knowledge of the Federal Zero Trust Strategy (OMB M-22-09)
Familiarity with federal cloud security requirements and FedRAMP-authorized environments
Experience supporting Moderate and/or High impact systems
Experience with Microsoft 365 office applications
Ability to engage effectively with technical teams and executive leadership
Active Public Trust clearance or ability to obtain a Public Trust clearance
Must be a US Citizen
Must pass pre-employment qualifications of Cherokee Federal
Prolonged periods of sitting at a desk and working on a computer; may occasionally require standing or moving about the office for extended periods
Preferred: Experience with ServiceNow, CSAM and/or comparable GRC tools
Preferred: Familiarity with Atlassian Confluence and JIRA
Preferred: Experience contributing to enterprise-level cybersecurity policy initiatives
Preferred: Familiarity with federal responsible AI guidance, including Executive Order 13960, OMB M-25-21 and M-25-22
Preferred: Experience supporting federal research or grant-management systems

Benefits

Comp & perks

Up to a 6% 401(k) company match
Paid time off
Medical, dental, and vision insurance
Prescription drug coverage
Basic life and AD&D insurance
Supplemental life insurance options
Short-term and long-term disability coverage
Paid holidays
Employee Assistance Program (EAP)
Flexible Spending Account (FSA) options
Health Savings Account (HSA) options
Professional development, training, and certification support
Voluntary accident, critical illness, and identity theft protection benefits