Cybersecurity Risk Analyst

Who are we?

MIT Lincoln Laboratory is a Federally Funded Research and Development Center (FFRDC) whose mission is research in support of National Security.

• Mission - The Security Services Department’s (SSD) overall mission is to identify and counter security threats to the MIT Lincoln Laboratory’s mission of development of game-changing technology in support of national security, including guarding against compromise by foreign intelligence agencies and insider threats.
• Culture – We foster an inclusive, opportunity-filled environment of empowered team members from diverse backgrounds.

What will you do?

Join a team of cybersecurity professionals that are driven to solve complex security problems in collaboration with Laboratory research teams. Core responsibilities include:

• Prepare the Laboratory for the Cybersecurity Maturity Model Certification (CMMC)
• Continuously validate the organization against cybersecurity policies/guidelines/procedures/regulations/laws to ensure compliance.
• Assist and Support necessary risk and compliance activities (e.g., ensure that cyber system security configurations guidelines are followed, compliance monitoring occurs).
• Maintain system security plan documentation and plans of action and milestones (POA&M)
• Perform assessments against NIST SP 800-171 and CMMC requirements
• Conduct continuous monitoring of system security controls
• Perform security reviews, identify gaps in security architecture, and develop security risk management plans
• Promote awareness of security issues among management and ensure sound security principles are reflected in the organization's vision and goals
• Conduct complex analysis of security risk on exception and waiver requests
• Assist in the development of policies and other documentation that reflect system security objectives while integrating applicable laws, statutes, and other regulatory requirements.
• Ensure systems are operated, maintained, and disposed of in accordance with organization security policies and procedures.
• Develop and promote processes and procedures to analyze and assess cybersecurity risks across an enterprise environment

How will you grow?

You will find significant opportunities to do meaningful work in an environment intentionally designed to be one where you will learn, thrive and belong.

• Leadership: Room to advance on your team or to lead cross-functional projects.
• Growth Opportunities: Potential for lateral and vertical movement.
• Education/Training: Management training, mentorship, in-house and external courses.
• Exposure: Engagement with sponsors, stakeholders, Laboratory leadership and other Departments and Divisions.
• Community: Participation is encouraged for Laboratory social events, Employee Resource Groups (ERGs), clubs and study groups, volunteering and community service projects.

What you need:

To work with MITLL, all employees must meet certain basic requirements.

• The ability to obtain and maintain a Secret clearance (clearance not needed to apply)
• Must be a U.S. Citizen.
• Successfully pass a background check
• Valid COVID-19 vaccination (to include a booster shot).
• Relevant education and/or experience

Ideally, you will have/Requirements:

The Laboratory values experiences from diverse backgrounds and occupations. The most successful candidates will have the following skills and qualifications.

• Education/Experience
  • A minimum of 4 years of IT security experience is preferred
  • Technical experience, skills, and course work completed towards an undergraduate degree, or industry IT certifications may be considered in lieu of education or IT security experience
• Risk Management and Assessment
  • The ability to read, understand and apply government regulation (FAR, DFARS)
  • Knowledge of information security standards and frameworks such as NIST SP 800-171, NIST SP 800-53, NIST SP 800-37, etc.
  • Familiarity with the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC)
  • A thorough knowledge of risk assessment methodology, such as NIST SP 800-30, Factor Analysis of Information Risk (FAIR), Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE), or other risk assessment practices
  • Experience developing and maintaining System Security Plans and associated artifacts, such as a Plans of Action & Milestones, Risk Assessment Report, and Continuous Monitoring Strategy
  • Familiarity with risk modeling tools, such as MITRE ATT&CK

Ideally, you will have/Requirements (cont.):

• Valued competencies
  • Exceptional interpersonal, organizational, written and verbal communication skills.
• Technical Competency
  • Experience as a system administrator will help you excel at this role
  • General knowledge of enterprise security tools, such as vulnerability scanners, log aggregators, networking & firewalls, VPNs
  • Industry certifications such as Security+, CISSP, CISA, CISM, etc.
  • Understanding of cloud technology and cloud security practices
  • Experience and familiarity with multiple operating systems such as Windows Server, Windows 10, Red Hat Enterprise Linux, Ubuntu, Mac, etc.
• Got more? Candidates with relevant backgrounds will be considered for higher cyber security risk analyst levels, including experience as an Information System Security Officer (ISSO), Information System Security Manager (ISSM), security engineer, system administrator, etc.