Cybersecurity Policy Analyst – Annual Policy Review

Position Overview:

Supports the Federal client’s Annual Policy Review work activity by reviewing, validating, analyzing, and updating cybersecurity policy and supplemental documentation to ensure continued alignment with NIST, OMB, FISMA, and other federal requirements, while helping maintain the broader security policy ecosystem.

Primary Responsibilities:

· Review, research, analyze, and validate existing written cybersecurity policies and standards, including the ISP, POMS, CUI, AIMS, and related supplemental documentation.

· Conduct annual reviews of POMS and CUI documentation to identify gaps, discrepancies, redundancies, and needed updates in alignment with federal mandates and client-specific requirements.

· Perform ongoing analysis and review of security policies and standards to ensure accuracy, completeness, and consistency with NIST 800-53, NIST CSF, OMB guidance, FISMA, and other applicable mandates.

· Review documents within the security policy ecosystem to confirm ownership, relevance, validity, retirement status, and required updates.

· Support policy and standards of maintenance by preparing draft updates, corrective recommendations, briefing materials, and related correspondence.

· Assist with policy waiver lifecycle support by attending SRB meetings, recording meeting minutes, documenting action items, and maintaining supporting records.

· Support acquisition and procurement activities by researching federal acquisition requirements and helping compile standard information security and supply chain risk language.

· Contribute to weekly status meetings, project updates, and quarterly reporting support for senior management and stakeholders.

· Use collaboration and document management tools to track actions, maintain records, and support policy review workflows.

Basic Qualifications – Required Education, Certifications, Skills, and Experience:

· Bachelor’s degree in cybersecurity, information systems, business, or a related discipline.

· Experience reviewing and validating existing written policy, standards, procedures, or governance documentation in a federal or regulated environment.

· Working knowledge of risk management processes and federal cybersecurity and privacy requirements, including NIST CSF, NIST 800-53, FISMA, FedRAMP, OMB guidance, RMF, FIPS, and related laws, regulations, and policies.

· Ability to analyze policies and supplemental documentation for gaps, inconsistencies, outdated language, and compliance impacts, and develop recommended revisions.

· Experience preparing drafts, technical reports, plans, meeting notes, and related correspondence.

· Strong written and verbal communication skills, with the ability to support reviews, meetings, and policy coordination activities.

· Strong organizational and analytical skills, including the ability to manage multiple review actions and maintain accuracy across a policy ecosystem.

· Experience using Jira, Confluence, ServiceNow, and the Microsoft 365 Office Suite, including Teams, Word, Excel, PowerPoint, and SharePoint.

· Must be able to hold a position in Public Trust.

Additional Requirements:

· Experience supporting information security policy programs, annual policy reviews, or policy ecosystem management in a federal agency.

· Familiarity with policy waiver tracking, SRB support, acquisition of security language, and CUI documentation reviews.

· Experience supporting cybersecurity policy updates tied to emerging federal mandates and external oversight requirements.

· Knowledge of document lifecycle governance, version control, and policy publication practices.

· Relevant certifications such as Security+, CGRC, CISSP, PMP, or policy/governance-related training.

Pay: $100,000.00 per year

Work Location: In person