IT Security Analyst

BridgePhase is a mission-focused technology company that designs, builds, secures, and operates modern digital solutions that drive national security, government efficiency, and mission success across the Federal Government. We empower agencies to achieve meaningful outcomes through high-performing software engineering, cloud, DevSecOps, cybersecurity, AI/ML, and platform modernization solutions delivered by collaborative teams focused on innovation, adaptability, and operational excellence. As a trusted partner, BridgePhase helps Federal organizations modernize critical systems, accelerate delivery, and achieve lasting mission impact.

• →Support cybersecurity operations and continuous compliance monitoring for enterprise cloud environments, ensuring alignment with FedRAMP, NIST, DoD, and other applicable Federal security requirements.
• →Develop, update, and maintain security documentation, compliance artifacts, policies, procedures, and authorization packages required to support ongoing system security and accreditation activities.
• →Maintain and support Plans of Action and Milestones (POA&Ms), tracking identified security weaknesses, remediation activities, and compliance milestones through resolution.
• →Collaborate with Cloud Operations and technical teams to identify, assess, prioritize, and remediate system vulnerabilities across cloud infrastructure, applications, and containerized environments.
• →Conduct vulnerability assessments and analyze potential attack vectors to determine exploitability, assess risk, and recommend appropriate remediation strategies.
• →Support the implementation of risk-based vulnerability management processes, prioritizing remediation efforts based on system exposure, security impact, and Federal compliance requirements.
• →Develop and maintain automation scripts using Python, Bash, PowerShell, or similar technologies to streamline vulnerability identification, analysis, reporting, and remediation workflows.
• →Analyze container security vulnerabilities using approved scanning tools, identifying operating system and application-level risks and coordinating corrective actions.
• →Support security assessments of CI/CD pipelines, container registries, AWS Elastic Container Registry (ECR), and container image management processes.
• →Assist with security authorization and accreditation activities, including Risk Management Framework (RMF) assessments, system categorization, security control evaluations, and authorization to operate (ATO) documentation.
• →Evaluate security control implementation and inheritance across cloud environments, ensuring compliance with applicable FedRAMP, NIST, and organizational security requirements.
• →Review and interpret system architecture documentation, network diagrams, connectivity models, and data flow diagrams to assess security posture and identify potential risks.
• →Apply Federal security frameworks and guidance, including FISMA, NIST SP 800-series publications, DISA Security Technical Implementation Guides (STIGs), and Security Requirements Guides (SRGs).
• →Support the development and implementation of security policies and procedures aligned with FedRAMP, NIST SP 800-171, and applicable Defense Federal Acquisition Regulation Supplement (DFARS) requirements.
• →Assess system security configurations, patching processes, vulnerability scanning mechanisms, and compliance status across development, testing, staging, and production environments.
• →Provide technical guidance and risk-based recommendations to stakeholders regarding evolving Federal cybersecurity regulations, cloud security requirements, and organizational security policies.
• →Collaborate with cybersecurity, engineering, cloud operations, and compliance teams to investigate security findings, resolve technical issues, and continuously improve security processes.
• →Prepare and present security assessments, compliance updates, vulnerability reports, and risk mitigation recommendations to technical teams, stakeholders, and leadership.

• Bachelor's degree in Computer Information Systems, Cybersecurity, Computer Science, Mathematics, or a related technical or scientific field.
• Experience supporting cybersecurity operations, vulnerability management, risk assessments, or security compliance initiatives within enterprise or Federal environments.
• Strong understanding of Federal cybersecurity frameworks and requirements, including FedRAMP, FISMA, NIST SP 800-series publications, and the NIST Risk Management Framework (RMF).
• Knowledge of DoD security requirements, including DISA STIGs, Security Requirements Guides (SRGs), and applicable Committee on National Security Systems (CNSS) guidance.
• Experience developing, maintaining, or supporting system security documentation, authorization packages, Plans of Action and Milestones (POA&Ms), and security policies and procedures.
• Understanding of security authorization and accreditation processes, including system categorization, security control assessments, risk analysis, and authorization to operate (ATO) requirements.
• Experience identifying, analyzing, and prioritizing vulnerabilities based on exploitability, system exposure, and potential security impact.
• Hands-on experience with vulnerability scanning tools and techniques, including container security scanning and remediation analysis.
• Experience developing or maintaining automation scripts using Python, Bash, PowerShell, Java, or similar programming languages.
• Knowledge of containerized environments, CI/CD pipelines, AWS Elastic Container Registry (ECR), and container image mirroring processes.
• Understanding of cloud security principles, enterprise infrastructure, operating systems, networking technologies, and application security controls.
• Ability to analyze technical architecture documentation, network diagrams, system connectivity, and data flow diagrams using tools such as Microsoft Visio.
• Familiarity with SAP products and their associated security considerations within enterprise cloud environments.
• Knowledge of NIST SP 800-171 security requirements, applicable DFARS clauses, and Federal information security and privacy requirements, including the Privacy Act.
• Experience supporting cybersecurity activities across development, testing, staging, pre-production, and production environments.
• Strong analytical and troubleshooting skills with the ability to assess complex technical environments, identify security risks, and recommend practical remediation strategies.
• Excellent written and verbal communication skills, including the ability to develop clear technical documentation and present security findings to both technical and non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple priorities, adapt to evolving security requirements, and work effectively in a fast-paced, team-oriented environment.
• Ability to work independently, take ownership of assigned responsibilities, and collaborate across cybersecurity, engineering, and cloud operations teams.
• Must be a U.S. citizen and hold only U.S. citizenship.

As with any dynamic technical environment, responsibilities will evolve based on customer and mission needs. We are looking for individuals who are adaptable, proactive, and eager to take ownership of new challenges as they arise.
 

BridgePhase was built around one simple belief: People who love where they work build better solutions. We bring top-tier engineering talent to the Government to support the nation's most critical work. Our people are not only technically exceptional, they're energized to deliver the engineering excellence, culture, and accountability our Government deserves. We thrive on building modern, secure, resilient solutions that accelerate mission outcomes, eliminate legacy barriers, and enable Government organizations to deliver faster and adapt smarter to meet today's demands and tomorrow's mission – without compromise.