Security Risk Analyst Jobs in Washington, DC (NOW HIRING)

ZERMOUNT POSITION DESCRIPTION (PD) SECURITY & RISK ENGINEER (SRE)POSITION OVERVIEWZermount Inc. is seeking a System Risk Engineer (SRE) to support system risk analysis and ensure that federal information systems comply with Information Assurance and cybersecurity standards. The SRE exists to ensure organizational systems are secure, resilient, and defensible in real-world operating conditions, not simply compliant with security documentation. This role directly contributes to mission assurance by identifying, validating, and reducing cybersecurity risk through direct technical assessment, control validation, and risk-based decision support across enterprise environments.Operating at the intersection of security engineering, risk assessment, and compliance, the SRE transforms federal mandates (e.g., NIST RMF, FISMA, EO 14028, OMB directives) into measurable security outcomes by validating the effectiveness of security controls within live systems. The role requires continuous evaluation of system posture through hands-on analysis of architectures, configurations, logs, vulnerability data, and control implementations across cloud, network, operating system, application, and database layers.This position demands foundational technical expertise across multiple domains, enabling the SRE to assess complex enterprise environments, identify exploitable conditions, and determine whether implemented security controls effectively reduce risk. The SRE is expected to go beyond documentation review and verify findings through system-level evidence, testing, and analysis, ensuring the findings reflect actual operational risk.The SRE is a core enabler of Zermount's Modern GRC mindset, which emphasizes:Continuous, real-time risk identification during compliance assessmentsRisk prioritization based on exploitability, exposure, and mission impactDirect integration with engineering and operations teams to drive remediationElimination of "check-the-box" compliance in favor of validated security outcomesYou will be directly responsible for supporting system authorization and mission assurance by producing objective, defensible, and technically accurate findings that enable Authorizing Officials, ISSOs, and system owners to make informed risk decisions. This includes conducting security control assessments, validating Zero Trust implementation, analyzing architectural and configuration changes, and ensuring that remediation actions are both effective and sustainable to reduce risk.DUTIES & RESPONSIBILITIESGeneral DutiesExecute Security Assessments (SA), Risk Assessments (RA), and Ongoing Authorization (OA) activities by validating security controls in live environments, not solely through documentation reviewConduct technical verification and validation of security controls across operating systems, applications, databases, cloud platforms, and network infrastructureIdentify real-world security risks, including exploitable vulnerabilities, misconfigurations, weak trust boundaries, and control failuresPerform continuous risk analysis using outputs from vulnerability scans, penetration testing, logging platforms, and configuration assessmentsDevelop risk-based findings and POA&M matrices, prioritizing remediation based on exploitability, exposure, and mission impactProduce executive-quality artifacts (SARs, risk memos, ATO packages, executive briefings) with validated, evidence-backed findingsConduct impact analysis for Requests for Change (RFCs), identifying security implications of architectural, configuration, or system modificationsValidate Zero Trust implementation and alignment across system architectures and capabilitiesPerform technical assessments of system architecture, data flows, and trust boundaries to identify control gapsConduct compliance validation for TIC, FISMA, and federal cybersecurity mandates through technical inspection and testingEnsure all deliverables meet accuracy standards with zero rework required and are aligned to program and client expectationsProvide weekly status reporting and briefings with clear articulation of risks, risk mitigation progress, and technical findingsSUBJECT MATTER EXPERTISE (SME)SME Area #1 - Primary Expertise: Security Assessment & Technical Risk ValidationExpert-level means:Deep knowledge of:NIST RMF (800-37, 800-53, etc.)FISMA, EO 14028, OMB M-21-31 / M-22-09FIPS 199/200TIC, Zero Trust principles (CISA ZT MM, NIST 800-207, etc.)Ability to independently conduct:Security Control Assessments (SCA)Risk Assessments (RA)ATO/OA activitiesCapability to validate controls using:System configurationsLogs and telemetryVulnerability scanning outputsConducting system interviews and demosAbility to identify real-world attack vectors and control failures, and develop actionable remediation actions that the system teams can use to successfully remediate findingsRequired Tools Experience:Vulnerability scanning tools such as: Tenable, Qualys, CrowdStrike, etc.Log analysis platforms such as: Splunk, Microsoft Sentinel, IBM QRadar, etc.Configuration and system inspection tools such as: Ansible, Terraform, Puppet, etc.GRC platforms such as: Archer, ServiceNow, etc.SME Area #2 - Secondary Expertise: Multi-Domain Technical DepthYou must have deep knowledge of one or more of the following technical domains and must demonstrate the ability to leverage this experience to inform and complete compliance-related tasks.Technical DomainsCloud: AWS/Azure (IAM, logging, network security, misconfigurations)Network: Segmentation, firewalls, boundary protections, Zero Trust enforcement pointsSystems: Windows/Linux hardening, identity systems (AD, MFA)Databases/Data: Access control, encryption, auditingQUALIFICATIONSMinimum Requirements7+ years of cybersecurity experience supporting U.S. Government systems4+ years performing RMF, ISSO, Assessment, or GRC functions with direct technical validation responsibilitiesDemonstrated hands-on experience in at least two technical domains (cloud, network, systems, or databases)Proven ability to analyze:System configurations, ATOs, and other supporting security documentationLogs/telemetryArchitecture documentation and data flow diagramsProven ability to conduct technical assessments across multiple domainsPreferred QualificationsExperience with Zero Trust assessments and implementation validationExperience with CDM, ISCM, and enterprise logging programsExperience supporting DHS/FISMA environmentsFamiliarity with threat-informed defense and attack vector analysisCompetencyAdvanced technical risk analysis and prioritizationIndependent problem-solving in ambiguous environmentsStrong collaboration with system teams, federal leadsAbility to translate complex technical findings into actionable recommendationsClear communication with both engineers and leadershipEducation & CertificationsBachelor of Science (B.S.) in Computer Science, IT, Cybersecurity, or a related field, and a minimum of 7 years of IT cybersecurity experience, including direct support for the US Government and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.Without a B.S. in a relevant field - A minimum of 13 years of IT Cybersecurity experience, including direct support for the US Government, and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.At least one of the following security certifications is required:Certified Authorization Professional (CAP)Certified Information Security Auditor (CISA)Certified Information Security Manager (CISM)Certified Information Systems Security Professional (CISSP), or Certified Chief Information Security Officer (CCISO)Governance Risk & Compliance Certification (CGRC)Or alternatively approved certificationsClearance LevelMinimum of active Secret Clearance and ability to obtain and maintain DHS suitabilityWORK LOCATIONThe position is primarily remote - Continental U.S onlyPrimary location when on site: Arlington, VA, and Springfield, VA Must be willing to travel - Not to exceed 10% of the time HOURS OF OPERATION8:00 am EST - 4:30 pm ESTTimes may fluctuate based on client and business requirementsREPORTING STRUCTUREReports To: Security Risk Engineering Team LeadDirect Reports: N/A