Info Security Analyst Salary in the United States

Change location

Participate in on-going operational activities that serve to establish appropriate access to and provide the appropriate protection, confidentiality, integrity and availability of enterprise systems and data through effective security controls.

Assists in coordinating, deploying, and managing IT security risk assessment activities of small to mid-size computing environments to identify points of vulnerability and/or non-compliance with established Information Assurance (IA) standards and regulations.

Provide assistance in developing, modifying, reviewing, and coordinating IT Categorization Determination packages, Information Assurance Strategies (IASs), Information Assurance Plans (IAPs), PPPs, SSPs, Information Assurance Assessments, System Assessments, Interconnection Security Agreements (ISAs), Verification and Validation testing, Development and Design, requirements identification, Baseline Control selection, Applicability Assessments, Mitigation Strategies, Milestone Requirements Assessments, Configuration Management reviews, Continuous Monitoring, IA Liaison functions between the Developer, User Community and Program Management, leading the IA Integrated Process Team (IAIPT).

Monitors and reports internal and external security threats, researches security threats, and recommends to senior staff the appropriate changes to the security program to prevent sensitive agency data from being compromised.

Performs periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system and external Web integrity scans to determine compliance.

Reviews the agency's systems including their infrastructure, processes and procedures to discover security compliance needs (non-compliance) to all applicable agency control requirements.

Develops, monitors, evaluates, and maintains system security plans and corrective action plans to ensure the protection of information systems and information resources from unauthorized users.

Understanding of the NIST Special Publications (800 Series) with particular emphasis on the SP 800-53 Security and Privacy Controls for Federal Information Systems & Organizations.

Requires understanding of DoD policies and procedures, including FIPS 199, FIPS 200, NIST 800-53, DHS 4300A SSH and other applicable policies.

Recommends new security tools to management and reports and provides guidance and expertise in their implementation.