Government and Infrastructure - Service Delivery Center - Cybersecurity - ISSO Analyst

• At EY, we’re all in to shape your future with confidence.
• We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.  Join EY and help to build a better working world.
• Government & Infrastructure – Service Delivery Cetner - Cyber Security, Strategy Risk, Compliance and Resiliency Analyst
• Your Key Responsibilities
• Support RMF delivery for assigned federal information systems by maintaining documentation, tracking actions and helping system owners and government security personnel complete authorization activities.
• Support RMF Prepare activities by maintaining system information, stakeholder lists, asset and component inventories, authorization boundary information, data-flow documentation, interconnections and risk context.
• Assist with information-type identification, NIST SP 800-60 mapping and FIPS 199 security categorization, and document the rationale and supporting information for review.
• Support control baseline selection and tailoring by documenting overlays, scoping decisions, organization-defined parameters, common controls and system-specific responsibilities.
• Draft and update authorization artifacts, including System Security Plans, control implementation statements, inventories, diagrams, assessment-readiness materials and supporting appendices.
• Collect, organize and map policies, procedures, configurations, screenshots, tickets, scan outputs and other evidence to applicable NIST SP 800-53 controls and assessment objectives.
• Review implementation statements and evidence for completeness, consistency and traceability, and elevate gaps or conflicting information to senior team members.
• Prepare evidence packages, interview materials, document-request trackers and response logs to help systems move efficiently through security control assessments.
• Participate in evidence-gathering sessions and control interviews with system owners, engineers, application teams and assessors; capture decisions, action items and follow-up requests.
• Assist with drafting assessment responses, findings, risk statements and corrective actions while preserving the independence of the assessment team.
• Create and maintain POA&M records, including weaknesses, responsible parties, milestones, scheduled completion dates, remediation evidence and closure documentation.
• Track POA&M progress, follow up on overdue actions, validate that required evidence has been provided and escalate schedule or risk issues.
• Execute continuous monitoring activities, including scheduled control reviews, vulnerability and configuration reporting, evidence refreshes and recurring status deliverables.
• Support security impact analyses for proposed system changes and document the affected components, controls, evidence and authorization artifacts.
• Review vulnerability scan results, STIG or CIS benchmark results and configuration data; help connect technical findings to NIST controls and remediation activities.
• Maintain accurate system records, workflows and authorization artifacts in federal governance, risk and compliance tools such as eMASS, JCAM, CSAM or Xacta.
• Perform first-level quality checks using established templates and checklists to identify missing information, inconsistent dates, unsupported conclusions and formatting issues.
• Track assigned deliverables and commitments, communicate progress clearly and raise blockers or emerging risks promptly.
• Collaborate effectively with engagement team members and client stakeholders, incorporate feedback and complete assigned work within expected timeframes.
• Stay current on federal cybersecurity requirements and actively develop technical, writing and RMF delivery skills.

None flagged.