Governance Analyst (R-00215)

This role bridges security engineering and day to day operations by supporting implementation of security capabilities, evaluating technical solutions, maintaining cybersecurity tools, and helping operational teams translate security architecture into effective, repeatable practices. The Cybersecurity Engineer works closely with vulnerability management, incident response, RMF, and ISSO teams to ensure engineering activities directly support operational risk reduction and continuous improvement.

Position Responsibilities

• Maintain traceability from Federal Zero Trust guidance and VA objectives to assessment criteria, architecture patterns, and implementation priorities.
• Support preparation and documentation for Architecture Review Boards, technical reviews, and executive governance forums.
• Maintain decision logs, exception records, architectural deviation records, and governance action tracking.
• Review deliverables for consistency with approved terminology, standards, scope boundaries, and documented Government priorities.
• Support governance of reusable pattern families, common system variants, and updates driven by implementation lessons learned.
• Coordinate documentation needed to transition implementation outcomes into sustainable governance and RMF processes.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems, Public Policy, Business, or a related field.
• Three or more years of cybersecurity governance, architecture governance, compliance, or Federal IT policy experience.
• Working knowledge of NIST SP 800-207, CISA Zero Trust Maturity Model, EO 14028, and Federal cybersecurity governance.
• Experience maintaining decision records, standards traceability, and governance documentation.
• Strong analytical writing and stakeholder coordination skills.
Preferred Qualifications:
• Experience supporting Federal architecture review or cybersecurity governance boards.
• Familiarity with FISMA, RMF, OMB memoranda, and Binding Operational Directives.
• Experience with policy mapping or requirements traceability tools.
Preferred Certifications: One or more of the following is preferred:
• CGRC
• CISSP
• CISM
• Security+