Information Security Analyst

As an Information Security Analyst, you support federal financial systems by testing IT general controls, evaluating control design and effectiveness, and helping reduce security and compliance risks. You execute A-123 ITGC and related DHS-aligned assessments, develop and track POA&Ms, and contribute to benchmarking and remediation efforts. The role works with finance, IT, and security stakeholders to embed NIST- and DHS-based security requirements into planning, system changes, and reporting.

Responsibilities

• Conduct ITGC testing and software test plans to identify control deficiencies impacting financial risk.
• Assist stakeholders in designing and operating IT controls that protect financial and financial-related data.
• Perform benchmarking, A-123 ITGC scoping, and support downgrades of IT deficiencies for CFO systems.
• Develop and track POA&Ms or remediation plans per DHS 4300
• A and OCISO guidance.
• Execute Tests of Design and Tests of Effectiveness for IT controls against NIST 800-53 and DHS policies.
• Support ad hoc IT assessments, including CIC, ATO, ATM and related financial system reviews.
• Collaborate with cross-functional teams to embed security requirements into planning, fieldwork, and reporting.
• Prepare status reports on security risks, control issues, and remediation progress for management.

Required Skills

• IT general controls (ITGC) testing
• NIST SP 800-53 Rev. 5 controls
• OMB A-123 and DHS 4300
• A compliance
• POA&M creation and management
• Test of Design (TOD) and Test of Effectiveness (TOE)
• DISA STIGs and DHS CEM framework
• Risk assessment for financial systems
• Internal control over financial reporting (ICFR)
• Security assessment and authorization (ATO support)
• Technical documentation and reporting