Cyber Security Risk Lead

TISTA Science and Technology Corporation is seeking a Cyber Security Risk Lead to support the Department of Veterans Affairs Supply Chain Management DevSecOps program. The role leads Assessment and Authorization, Authority to Operate, cybersecurity risk, vulnerability management, and compliance activities across the product portfolio while coordinating with VA security stakeholders and delivery teams.

Responsibilities:

• Manage ATO activities, authorization status, security risks, and POA&M activities across supported products
• Develop and maintain A&A artifacts in accordance with NIST RMF and applicable VA security requirements
• Coordinate security assessments, evidence requests, findings, and remediation activities with VA security stakeholders and delivery teams
• Lead vulnerability tracking, risk assessments, remediation reporting, and security compliance activities
• Support privacy and security requirements for cloud, containerized, and integrated systems
• Ensure security authorization requirements and evidence are incorporated into release and Agile planning activities
• Support security incident response documentation and reporting
• Maintain reusable A&A templates, risk reporting standards, and security compliance practices
• Contribute to TISTA’s cybersecurity practice, business growth, and continuous improvement initiatives

Requirements:

• 8+ years of information security experience, including 4+ years as an ISSO, ISSM, Security Control Assessor, or A&A lead supporting federal IT programs
• Demonstrated experience authoring and maintaining complete A&A packages under the NIST Risk Management Framework, including System Security Plans, Risk Assessments, PIAs, Security Configuration Checklists, ISAs, and MOUs
• Hands-on experience managing POA&Ms, security control evidence, and federal GRC activities
• Experience with vulnerability management, remediation tracking, and security risk assessments
• Experience supporting cloud-hosted or containerized systems and inherited security controls
• Working knowledge of DevSecOps security practices and tools
• ISC2 CISSP required
• ISACA CISM required or must be obtained within 12 months of hire
• GIAC Security Leadership Certification (GSLC) required or must be obtained within 12 months of hire
• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related field
• Tier 2 / Moderate Risk Background Investigation; ability to obtain a VA PIV credential
• Experience with VA OIT, VHA, or other federal health cybersecurity environments, including familiarity with VA Handbook 6500, VA Critical Security Controls, and VA security processes, strongly preferred
• Master's degree preferred