ATO Security Analyst

About the role

IronArch Technology is seeking an ATO Security Analyst to support the Department of Veterans Affairs in maintaining cybersecurity compliance across VA research environments. This is a documentation-first role focusing on developing, reviewing, and maintaining ATO and ATC packages, including system security plans (SSPs), control implementation statements, FISMA documents, and POA&Ms.

Responsibilities

• Develop, review, and maintain ATO and ATC packages including system security plans (SSPs), control implementation statements, FISMA documents, and POA&Ms across a portfolio of VA research systems.
• Own the tracking and resolution of open POA&M items, keep authorization schedules current, and ensure nothing falls through the cracks.
• Support all RMF steps from security categorization through authorization, coordinating directly with VA ISOs, ISSOs, site managers, and system owners to close gaps and hit deadlines.
• Answer cybersecurity compliance questions for research teams using current VA Handbooks, Directives, and NIST guidance.
• Conduct security assessment reviews for VA research submissions, work within the VA's Continuous Authorization and Monitoring (CAM) framework, and support product installation planning for major system changes.
• Lead client-facing meetings on ATO topics regularly, walking both technical and non-technical audiences through complex authorization status clearly and confidently.

Requirements

• Bachelor's degree in computer science, electronics engineering, or another engineering or technical discipline, plus 5 years of relevant experience. 13 years of relevant experience may substitute in lieu of a degree (8 additional years may substitute for education per contract requirements).
• Hands-on experience with the full RMF lifecycle, categorization through authorization, and ability to create and maintain SSPs, control implementation statements, POA&Ms, and FISMA security documentation without a lot of handholding.
• Working knowledge of NIST SP 800-53 is a hard requirement. Ability to read authorization documentation, find gaps, build a plan to address them, and communicate it clearly to people who may not have a security background is essential.
• Ability to manage a lot of open items simultaneously including multiple systems, multiple deadlines, and different expiration windows while keeping everything current and accurate.
• Experience with ServiceNow's Continuous Authorization and Monitoring (CAM) application is a plus, as is familiarity with VHA Research and Development Policies, VA Handbook 1200, and VA 6500 Handbooks and Directives.
• Experience with specialized or connected devices is relevant.
• Active Public Trust clearance is not required to apply but will accelerate your onboarding timeline if you have one.

Qualifications

• U.S. citizenship required.
• Comfortable using AI tools to assist with documentation drafting, artifact review, and compliance gap analysis.
• Understands that AI accelerates RMF documentation work, but that accuracy and human review are non-negotiable in an authorization context.

Skills

• Strong communication and interpersonal skills.
• Attention to detail and ability to manage multiple tasks simultaneously.
• Knowledge of VA policies and procedures.
• Ability to work independently and as part of a team.
• Proficiency in Microsoft Office Suite.

Benefits

• Competitive compensation and market-leading bonus opportunities.
• Medical, dental, and vision benefits where a significant portion of the premium is subsidized by IronArch.
• Health Reimbursement Account (HRA) to cover eligible medical expenses.
• 401(k) retirement plan with company matching contributions.
• 20 days of paid time off per calendar year.
• 11 paid holidays.
• Bereavement, jury duty, parental (maternity/paternity/adoption), and military leaves.
• Sabbatical programs.
• Short- and long-term disability coverage.
• Life insurance.
• Pet insurance.
• Professional development reimbursement.
• Health club reimbursement.
• Matching donation program and annual philanthropic activities.

Pay

$84,000 – $101,000

Schedule

Remote, U.S.-based. Occasional travel may be required to support program needs.