Info Security Analyst Salary in Massachusetts

Participate in on-going operational activities that serve to establish appropriate access to and provide the appropriate protection, confidentiality, integrity and availability of enterprise systems and data through effective security controls.

Requires understanding of DoD policies and procedures, including FIPS 199, FIPS 200, NIST 800-53, DHS 4300A SSH and other applicable policies.

Assists in coordinating, deploying, and managing IT security risk assessment activities of small to mid-size computing environments to identify points of vulnerability and/or non-compliance with established Information Assurance (IA) standards and regulations.

Recommends new security tools to management and reports and provides guidance and expertise in their implementation.

Performs periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system and external Web integrity scans to determine compliance.

Provide assistance in developing, modifying, reviewing, and coordinating IT Categorization Determination packages, Information Assurance Strategies (IASs), Information Assurance Plans (IAPs), PPPs, SSPs, Information Assurance Assessments, System Assessments, Interconnection Security Agreements (ISAs), Verification and Validation testing, Development and Design, requirements identification, Baseline Control selection, Applicability Assessments, Mitigation Strategies, Milestone Requirements Assessments, Configuration Management reviews, Continuous Monitoring, IA Liaison functions between the Developer, User Community and Program Management, leading the IA Integrated Process Team (IAIPT).

Reviews the agency's systems including their infrastructure, processes and procedures to discover security compliance needs (non-compliance) to all applicable agency control requirements.

Understanding of the NIST Special Publications (800 Series) with particular emphasis on the SP 800-53 Security and Privacy Controls for Federal Information Systems & Organizations.

Monitors and reports internal and external security threats, researches security threats, and recommends to senior staff the appropriate changes to the security program to prevent sensitive agency data from being compromised.

Develops, monitors, evaluates, and maintains system security plans and corrective action plans to ensure the protection of information systems and information resources from unauthorized users.