Remote Cybersecurity Policy Analyst Jobs (NOW HIRING)

Job Title: Senior Cybersecurity Analyst

Work Location: Remote or hybrid remote if near CO/VA offices

Labor Category: Exempt

Clearance Level: Secret

Travel: Up to 20%

Pay Rate: $91,000 - $124,000

About the Role 

This role works collaboratively with IT leadership, systems administrators, business units, compliance personnel, vendors, auditors, and other stakeholders, the Senior Cybersecurity Analyst will help establish and maintain a risk-based, defense-in-depth cybersecurity program that supports organizational operations, contractual obligations, regulatory requirements, and the protection of critical information assets. The position requires a combination of strong technical cybersecurity expertise, analytical and investigative capabilities, regulatory and compliance knowledge, documentation skills, and the ability to communicate cybersecurity risk effectively to both technical and non-technical audiences.

What You'll Be Doing

• Monitor, investigate, and respond to cybersecurity alerts, incidents, vulnerabilities, and threats across enterprise, endpoint, cloud, network, and application environments.
• Support compliance with NIST SP 800-171, CMMC, and applicable federal/DoD cybersecurity requirements, including protection of CUI and FCI.
• Implement, assess, document, and continuously monitor cybersecurity controls and maintain SSPs, POA&Ms, policies, procedures, and compliance evidence.
• Conduct cybersecurity risk assessments, vulnerability assessments, and security reviews; prioritize findings and coordinate remediation efforts.
• Support internal and external audits, CMMC assessments, customer reviews, and other cybersecurity compliance activities.
• Analyze security logs, alerts, and threat intelligence using tools such as SIEM, EDR, Microsoft 365, Azure, Entra ID, firewalls, and endpoint security platforms.
• Participate in incident response activities, including investigation, containment, remediation, recovery, documentation, and post-incident reviews.
• Assess and improve security configurations, system hardening, patch management, endpoint protection, network security, cloud security, and data protection controls.
• Support identity and access management, including MFA, Conditional Access, privileged access, least privilege, RBAC, and periodic access reviews.
• Evaluate security posture across Microsoft 365, GCC High, Azure, Entra ID, Active Directory, and other enterprise platforms.
• Support third-party/vendor risk management, technology security reviews, change management, and cybersecurity assessments for new systems and services.
• Develop cybersecurity metrics, dashboards, risk registers, vulnerability reports, and compliance reporting for leadership.
• Develop and maintain cybersecurity policies, standards, procedures, incident response plans, and security documentation.
• Support security awareness programs, phishing simulations, cybersecurity training, and organization-wide security initiatives.
• Provide cybersecurity guidance to employees, IT teams, leadership, vendors, auditors, and assessors.
• Stay current on emerging threats, vulnerabilities, regulations, cybersecurity frameworks, and industry best practices.
• Serve as a senior cybersecurity resource and escalation point for complex security, risk, compliance, and incident response matters; mentor junior team members as appropriate.
• Participate in after-hours incident response or emergency cybersecurity support as required.
• Perform other cybersecurity, information assurance, risk management, and compliance duties as assigned.

What We're Looking For

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field; equivalent education, certifications, training, and experience may be considered.
• 7+ years of cybersecurity, information security, information assurance, risk management, or related IT security experience, including 3+ years in a senior-level cybersecurity role within a complex enterprise environment.
• Strong knowledge of NIST SP 800-171, CMMC, and federal/DoD contractor cybersecurity requirements, including protection of CUI and FCI.
• Experience with SSPs, POA&Ms, security controls, compliance evidence, risk assessments, audits, and CMMC readiness/assessments.
• Experience with vulnerability management, including scanning, analysis, prioritization, remediation, and validation.
• Hands-on experience with SIEM, EDR, endpoint security, firewalls, identity/security monitoring tools, and cybersecurity incident response.
• Experience securing Microsoft 365/GCC High, Azure, Entra ID, and Active Directory, including MFA, Conditional Access, RBAC, privileged access, and identity security.
• Working knowledge of Windows Server, endpoint technologies, network infrastructure, TCP/IP, VLANs, firewalls, VPNs, virtualization, cloud services, and network security.
• Experience with endpoint protection, EDR, encryption, system hardening, secure configurations, access controls, patch management, and configuration management.
• Experience conducting cybersecurity risk assessments, control gap analyses, security reviews, and risk mitigation activities.
• Ability to translate technical and regulatory requirements into practical security controls, procedures, technical requirements, and remediation plans.
• Experience with vendor/third-party risk management, cybersecurity policies and procedures, incident response planning, and security documentation.
• Strong analytical, investigative, problem-solving, communication, and organizational skills, with the ability to manage multiple cybersecurity priorities.
• Ability to work independently and collaborate effectively with IT teams, leadership, business units, vendors, auditors, assessors, and other stakeholders.
• Ability to provide senior-level technical guidance and mentoring to IT and cybersecurity personnel.
• Ability to support after-hours incident response or emergency cybersecurity activities as required.
• Must be legally authorized to work in the United States and meet all applicable U.S. Government/DoD background, eligibility, and security requirements.
• Must possess or be able to obtain and maintain an active U.S. Government security clearance at the level required for assigned contracts.

Physical Demands & Work Environment

• Ability to work in an office environment with prolonged periods of sitting and computer use.
• Ability to travel domestically up to 20% as business needs require.
• Ability to lift up to 25 pounds occasionally.