IT Security Analyst

BridgePhase is a mission-focused technology company that designs, builds, secures, and operates modern digital solutions that drive national security, government efficiency, and mission success across the Federal Government. We empower agencies to achieve meaningful outcomes through high-performing software engineering, cloud, DevSecOps, cybersecurity, AI/ML, and platform modernization solutions delivered by collaborative teams focused on innovation, adaptability, and operational excellence. As a trusted partner, BridgePhase helps Federal organizations modernize critical systems, accelerate delivery, and achieve lasting mission impact.

Position Overview:

BridgePhase is seeking a detail-oriented, self-driven IT Security Analyst to support cybersecurity operations, vulnerability management, and continuous compliance efforts within a FedRAMP-authorized cloud environment. This individual will work closely with cybersecurity, cloud operations, and technical teams to maintain security documentation, assess system vulnerabilities, support risk management activities, and ensure enterprise systems remain aligned with Federal security requirements and established compliance frameworks.
 

The ideal candidate brings a strong understanding of Federal cybersecurity standards, risk management frameworks, and cloud security practices, along with hands-on experience in vulnerability assessment, security documentation, and remediation coordination. This role requires a proactive problem solver who can analyze complex technical environments, identify and prioritize security risks, collaborate across technical teams, and support the ongoing security and compliance of mission-critical enterprise systems.
 

This position requires candidates to be U.S. citizens who hold no additional citizenship. This is a hybrid role requiring onsite work in Herndon, VA, three days per week (Tuesday, Wednesday, and Thursday), with the potential to increase to five days per week based on business needs.
 

Key Responsibilities:

• Support cybersecurity operations and continuous compliance monitoring for enterprise cloud environments, ensuring alignment with FedRAMP, NIST, DoD, and other applicable Federal security requirements.
• Develop, update, and maintain security documentation, compliance artifacts, policies, procedures, and authorization packages required to support ongoing system security and accreditation activities.
• Maintain and support Plans of Action and Milestones (POA&Ms), tracking identified security weaknesses, remediation activities, and compliance milestones through resolution.
• Collaborate with Cloud Operations and technical teams to identify, assess, prioritize, and remediate system vulnerabilities across cloud infrastructure, applications, and containerized environments.
• Conduct vulnerability assessments and analyze potential attack vectors to determine exploitability, assess risk, and recommend appropriate remediation strategies.
• Support the implementation of risk-based vulnerability management processes, prioritizing remediation efforts based on system exposure, security impact, and Federal compliance requirements.
• Develop and maintain automation scripts using Python, Bash, PowerShell, or similar technologies to streamline vulnerability identification, analysis, reporting, and remediation workflows.
• Analyze container security vulnerabilities using approved scanning tools, identifying operating system and application-level risks and coordinating corrective actions.
• Support security assessments of CI/CD pipelines, container registries, AWS Elastic Container Registry (ECR), and container image management processes.
• Assist with security authorization and accreditation activities, including Risk Management Framework (RMF) assessments, system categorization, security control evaluations, and authorization to operate (ATO) documentation.
• Evaluate security control implementation and inheritance across cloud environments, ensuring compliance with applicable FedRAMP, NIST, and organizational security requirements.
• Review and interpret system architecture documentation, network diagrams, connectivity models, and data flow diagrams to assess security posture and identify potential risks.
• Apply Federal security frameworks and guidance, including FISMA, NIST SP 800-series publications, DISA Security Technical Implementation Guides (STIGs), and Security Requirements Guides (SRGs).
• Support the development and implementation of security policies and procedures aligned with FedRAMP, NIST SP 800-171, and applicable Defense Federal Acquisition Regulation Supplement (DFARS) requirements.
• Assess system security configurations, patching processes, vulnerability scanning mechanisms, and compliance status across development, testing, staging, and production environments.
• Provide technical guidance and risk-based recommendations to stakeholders regarding evolving Federal cybersecurity regulations, cloud security requirements, and organizational security policies.
• Collaborate with cybersecurity, engineering, cloud operations, and compliance teams to investigate security findings, resolve technical issues, and continuously improve security processes.
• Prepare and present security assessments, compliance updates, vulnerability reports, and risk mitigation recommendations to technical teams, stakeholders, and leadership.

Education & Experience Requirements:

• Bachelor's degree in Computer Information Systems, Cybersecurity, Computer Science, Mathematics, or a related technical or scientific field.
• Experience supporting cybersecurity operations, vulnerability management, risk assessments, or security compliance initiatives within enterprise or Federal environments.
• Strong understanding of Federal cybersecurity frameworks and requirements, including FedRAMP, FISMA, NIST SP 800-series publications, and the NIST Risk Management Framework (RMF).
• Knowledge of DoD security requirements, including DISA STIGs, Security Requirements Guides (SRGs), and applicable Committee on National Security Systems (CNSS) guidance.
• Experience developing, maintaining, or supporting system security documentation, authorization packages, Plans of Action and Milestones (POA&Ms), and security policies and procedures.
• Understanding of security authorization and accreditation processes, including system categorization, security control assessments, risk analysis, and authorization to operate (ATO) requirements.
• Experience identifying, analyzing, and prioritizing vulnerabilities based on exploitability, system exposure, and potential security impact.
• Hands-on experience with vulnerability scanning tools and techniques, including container security scanning and remediation analysis.
• Experience developing or maintaining automation scripts using Python, Bash, PowerShell, Java, or similar programming languages.
• Knowledge of containerized environments, CI/CD pipelines, AWS Elastic Container Registry (ECR), and container image mirroring processes.
• Understanding of cloud security principles, enterprise infrastructure, operating systems, networking technologies, and application security controls.
• Ability to analyze technical architecture documentation, network diagrams, system connectivity, and data flow diagrams using tools such as Microsoft Visio.
• Familiarity with SAP products and their associated security considerations within enterprise cloud environments.
• Knowledge of NIST SP 800-171 security requirements, applicable DFARS clauses, and Federal information security and privacy requirements, including the Privacy Act.
• Experience supporting cybersecurity activities across development, testing, staging, pre-production, and production environments.
• Strong analytical and troubleshooting skills with the ability to assess complex technical environments, identify security risks, and recommend practical remediation strategies.
• Excellent written and verbal communication skills, including the ability to develop clear technical documentation and present security findings to both technical and non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple priorities, adapt to evolving security requirements, and work effectively in a fast-paced, team-oriented environment.
• Ability to work independently, take ownership of assigned responsibilities, and collaborate across cybersecurity, engineering, and cloud operations teams.
• Must be a U.S. citizen and hold only U.S. citizenship.

As with any dynamic technical environment, responsibilities will evolve based on customer and mission needs. We are looking for individuals who are adaptable, proactive, and eager to take ownership of new challenges as they arise.
 

About Our Company:

BridgePhase was built around one simple belief: People who love where they work build better solutions. We bring top-tier engineering talent to the Government to support the nation's most critical work. Our people are not only technically exceptional, they're energized to deliver the engineering excellence, culture, and accountability our Government deserves. We thrive on building modern, secure, resilient solutions that accelerate mission outcomes, eliminate legacy barriers, and enable Government organizations to deliver faster and adapt smarter to meet today's demands and tomorrow's mission – without compromise.
 

Our Benefits:

At BridgePhase, we invest in our people with benefits that support your life, reward your impact, and reflect what matters most – both on the job and beyond it. Employee benefits include:

• Competitive compensation that reflects your skills and impact
• Multiple bonus programs rewarding performance, company growth, and employee referrals
• Flexible PTO with 20 days to use when you need them
• All federal holidays paid to help you truly recharge
• 7 paid sick days because health always comes first
• 100% paid parental leave
• 401(k) with 6% match and no vesting period
• Top-tier medical, dental, and vision plans with low out-of-pocket costs
• Short- and long-term disability and life insurance included
• Pet insurance to support your four-legged family
• Annual professional development budget for training, certifications, and conferences
• Two paid community service days for causes that matter to you
• Social pod budget to connect with teammates wherever you live