Role Description The Junior Cyber Security Assurance Analyst will be responsible for providing support for system security assessments of a cloud-based, NIST-regulated systems. Works with technical and functional teams to define, document, and deliver security documentation and artifacts that demonstrate compliance with required security controls. Supports the remediation and tracking of identified deficiencies and works with the Security team to support continuous diagnostic and monitoring programs as needed. Supports the security work stream within the system release/change management process. Reviews planned system changes, helps identify and document security impacts, helps coordinate security scanning, testing, reporting as well as production readiness and post implementation support activities. Successful candidates will work closely with U.S. Federal Government clients, including Information System Security Officers (ISSO), System Owner, Cyber security team, and other groups as needed on release related activities. Updates established work plans for Security release activities. Qualifications - Implement, administer, and use cybersecurity tools, systems and applications; develop policies, standards, and guidelines to ensure secure enterprise-wise operations, performance and resiliency. - Deploy and secure security systems, application layer and traditional firewalls, vulnerability management and forensics utilities, and other infrastructure deployed and maintained by the Information Security Office. - Develop plans to safeguard information against unauthorized access modification, and destruction, and ensure organizational continuity of operations. - Monitor, research, and respond to cyber related events and incidents such as malicious code detection, intrusion, detection, system configuration, and patch management issues. - Conduct risk assessments, audits, and validate that system functionality, and security controls are implemented appropriately according to policy and industry best practices. - Conduct cybersecurity training and outreach organization-wide. Requirements - BA or BS degree, or at least 4 years of experience in related field - Minimum 1+ years supporting OR conducting federal system security assessments - Minimum 1+ years developing formal security documentation - Minimum 1+ years assessing and remediating security findings - Minimum 1+ years exposure to the SDLC - Minimum 1+ years experience with Release Management or Change Management - Thorough knowledge of NIST SP 800-series security guidelines - Active clearance, or ability and willingness to submit for a clearance may be required - Approved to work in the United States - Excellent written and oral communication skills - Ability to work well in a team environment Benefits - Competitive salary, paid twice per month - Best in class medical coverage - 100% of medical premiums covered by True Zero - Company wide new business incentive programs - Contribution Incentives (i.e. white papers, blog posts, internal webinars, etc.) - 3 weeks of PTO starting + 11 Paid Holidays Annually - 401k Program with 100% company match on the first 4% - Monthly reimbursement of Cell Phone and Home Internet costs - Paternity/Maternity Leave - Investment in training and certifications to broaden and deepen your technical skills

Role Description The contractor shall support the Pharmacy Operations Division (POD) Informatics System Security Manager (ISSM) in cybersecurity matters by providing analytic and technical advice to support DoD Cybersecurity policies and activities. - Assist the ISSM with development, review, and management of cybersecurity documentation (e.g., System Authorization Plans, Categorization Memos, Plan of Action, and Milestones (POA&M), hardware and software lists, boundary diagrams). - Work with vendors to ensure compliance requirements are met with the focus of achieving Authorization to Operate (ATO) for all packages. - Ensure compliance with 8582.01 controls to maintain system security throughout the lifecycle. - Confirm the validity of hardware and software lists, architecture diagrams, and resolve findings through remediation/mitigation statements in the system POA&M. - Assess configuration changes to determine overall impact to the security posture of the system. - Analyze system administrator generated vulnerability scans from various tools (e.g., Automated Compliance Assessment Solution (ACAS), Host Based System Security (HBSS), Security Content Automation Protocol (SCAP) Nessus) and review Security Technical Implementation Guides (STIGS) and checklists to provide vulnerability assessments at the system level. - Utilize reporting tools (e.g., Enterprise Mission Assurance Support Services (eMass) and Continuous Monitoring and Risk Scoring (SMRS) for documentation and evidence of assessment results for each system. - Establish an enduring hardware lifecycle and software license management process to implement and maintain cybersecurity posture. - Develop a threat-based defense against adversaries and deploy a more effective, efficient, and realistic cybersecurity operations. Qualifications - Bachelor's Degree or 8 years' experience in Cybersecurity support. - CompTIA Security+. - DoD-approved Cybersecurity workforce certification Information Assurance Technical (IAT) Level III per DoD 8570.01-M (e.g., CISSP, CISA, CASP CE). Requirements - Eight or more years cybersecurity experience. - Experience assessing new security laws, policies, and standards in the federal government. - Possess technical knowledge of National Institute of Standards and Technology (NIST), Risk Management Framework (RMF), Federal Risk and Authorization Management Program (FedRAMP) with a solid understanding of cloud deployment, security policy requirements and assessments, and service models as defined by the NIST. - Understanding of IP networking, networking protocols and security-related technologies including encryption, IPsec, PKI, VPN, firewalls, proxy services, DNS, electronic mail and access-lists. - Possess depth knowledge of security hardening, assessment and reporting tools (e.g. HBSS, ACAS, SCAP, etc.) with the ability to assess and provide appropriate feedback for external audits and remediation plans. Preferred Knowledge/Experience - Possess excellent written and oral communication skills. - Proficient in Microsoft Office Suite Applications: Excel, Outlook, PowerPoint, Word, Visio. Physical Requirements - Remote work in a private and suitable location. - Private secure high efficiency home internet access. - Private secure high efficiency telecommunications. Other Responsibilities - Standard Monday through Friday day schedule, but may travel and/or work weekends and extended hours if needed with approval of program manager and government leads.

• Apply RBAC and IAM expertise to support role design, access governance, and identity lifecycle processes. • Lead requirements elicitation and documentation, translating business needs into clear functional and technical specifications. • Perform access and role modeling, including analysis of current (“as-is”) processes and design of optimized (“to-be”) role structures. • Facilitate stakeholder communication and workshops to align business, security, and technical teams on access policies and solutions. • Support testing and validation activities, including UAT, to ensure RBAC implementations meet business, security, and compliance requirements.

Role Description As the Jr. Policy and Security Awareness Analyst, support College Board’s Security Policy Management and Security Awareness programs. You will work at the direction of the Senior Director, Governance and Risk to coordinate policy reviews using the ISGRC tool, One Trust and security awareness activities using the ISGRC tool, KnowBe4. This role is designed as an entry point into Information Security Governance, Risk, and Compliance with a possible opportunity to develop into more advanced security, audit, or risk roles within the organization. In this role, you will: - Security Policy (40%) - Assist in planning, executing, and managing security policy reviews and approval activities to ensure alignment with industry standards and business objectives. - Maintain and organize the enterprise policy library within One Trust and other designated repositories. - Research, interpret, and map policy requirements to compliance controls for audit readiness. - Conduct routine policy reviews to identify gaps or outdated content and recommend updates. - Support policy enforcement efforts and work with leadership to ensure consistent organization-wide compliance. - Maintain a Generative AI–powered chatbot built on Microsoft Copilot to answer common InfoSec policy questions. - Develop dashboards and reports that highlight training gaps, policy risks, and awareness trends. - Security Awareness (40%) - Support and continuously improve organization-wide security awareness training using KnowBe4. - Plan, execute, analyze, and report monthly phishing simulations. - Collaboration & Delivery (20%) - Support broader ISGRC initiatives designed to strengthen governance and risk management. - Develop dashboards, reports, and metrics to inform leadership about progress and effectiveness of policy and security awareness initiatives. - Perform other duties assigned to support ISGRC and enterprise security objectives. - Contribute to automation or AI-enabled improvements in policy or security awareness workflows. Qualifications - Preferred backgrounds include Computer Science, Information Systems, Cybersecurity, Data Analytics, Public Policy (with quantitative or technology focus), or related disciplines. - Excellent communication (written and verbal) and effective interpersonal skills. - Strong planning, prioritization, and execution skills, capable of managing multiple projects in fast-paced, evolving environments. - Experience working with structured data (e.g., Excel, Google Sheets, SQL, or Python) to organize, analyze, or report on information is preferred. - Experience using AI tools to analyze, summarize, or extract insights from documents. Familiarity with prompt structuring, workflow automation, or API-based usage is strongly preferred. - A critical thinker, a solid drive to excellence, a strong attention to detail, an insatiable appetite for continuous improvement, and a constant need to learn, practice, and improve. - Enthusiasm to learn through a combination of structured, on-the-job, and self-directed training. - Desire to explore a career in Information Security or Information Security, Governance, Risk and Compliance. - Interest in pursuing foundational security certifications such as ISC2 Certified in Cybersecurity (CC), CompTIA Security+, or ISO 27001, with longer-term development toward certifications like CISA or CISSP. - Ability to work efficiently and effectively in a remote team environment. - Ability to communicate the value of compliance work in clear business terms, helping stakeholders understand how audit readiness, effective controls, and timely remediation reduce risk, protect trust, and support College Board’s mission. Requirements - Preferred - Working in a security environment with experience in security awareness or policy management. - Bachelor’s degree preferred. - The ability to travel 3-4 times a year to College Board offices or on behalf of College Board business. Benefits - At College Board, we offer more than a paycheck- we provide a meaningful career, a supportive team, and a comprehensive package designed to help you thrive. - We’re a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market. - The hiring range for this role is $48,000 – $75,000. Your exact salary will depend on your location, experience, and how your background compares to others in similar roles at the College Board. - We aim to make our best offer upfront, rooted in fairness, transparency, and market data. - We adjust salaries by location to ensure fairness, no matter where you live. - You’ll have open, transparent conversations about compensation, benefits, and what it’s like to work at College Board throughout your hiring process.