• Maintain various EPA System security and privacy control implementation deliverables based on a NIST 800-53 rev5 control framework. • Update, maintain, and drive security and privacy documentation designed to protect the cloud- and host-based systems from both internal and external threats. • Review identified cyber security vulnerabilities and assist with the recommendation, documentation, and implementation of appropriate mitigations or countermeasures. • Conduct and support periodic reviews of the information system to ensure compliance with the security and privacy authorization package. • Review, create, and enhance security and privacy documentation to ensure continued compliance with security and privacy requirements. • Coordinate the response to the annual continuous monitoring assessment audit. • Ensure audit evidence are collected, reviewed, and documented, including any risk determinations and plans of actions and milestones. • Identify and notify the program manager when changes occur that might affect the authorization determination for the information system. • Provide analysis of systems, hardware, software, and maintenance needs. • Create and review annually the security- and privacy-related documentation. • Develop, coordinate, and conduct training and tabletop exercises related to continuity of operations, contingency planning, incident handling, awareness, etc. • Update control implementation tools like XACTA to maintain compliance against NIST 800-53 rev 5.

• Execute vulnerability management activities using ACAS, ESS, SCAP tools, and manual validation techniques to confirm findings and reduce false positives. • Conduct application and web vulnerability assessments using tools such as Burp Suite and document results with clear remediation guidance. • Support vulnerability triage and prioritization based on mission impact, exposure, exploitability, and operational constraints. • Support the Vulnerability Disclosure Program (VDP) by managing intake, validation, tracking, and coordination with remediation stakeholders. • Ensure vulnerability findings, evidence, and remediation status are accurately documented and traceable within RMF artifacts (e.g., assessment inputs and POA&M updates). • Support SCAP/STIG-related validation by correlating scan results to configuration baseline requirements and documenting compliance status. • Demonstrate the ability to perform—or a strong willingness to learn—security assessment activities across ACAS, ESS, Burp Suite, VDP workflows, and SCAP/STIG compliance processes. • Cloud Security: Configure and manage AWS Security toolsets (CloudTrail, GuardDuty, Inspector, Security Hub). • Execute DISA STIG compliance activities across operating systems, applications, databases, and network devices • Validate security baselines using SCAP and manual assessment techniques • Identify deviations, document compensating controls, and support risk acceptance requests • Ensure configuration compliance aligns with mission requirements and operational constraints • Maintain and update RMF packages throughout the system lifecycle • Support ATO, IATT, and continuous monitoring activities • Track POA&Ms and remediation actions to completion • Coordinate with Government System Owners, ISSOs, ISSEs, and Authorizing Officials • Support cybersecurity assessments, inspections, and compliance reviews • Support SIEM monitoring and alert analysis • Assist with ESS deployment, configuration, and reporting • Support log analysis, threat detection, and incident response activities • Assist with continuous monitoring and cybersecurity metrics reporting

• Coordinate and execute recurring GRC tasks such as quarterly access reviews, audit evidence collection, and risk register reconciliation. • Document and track completion of control activities and escalate issues where needed. • Assist with internal and external audits, ensuring timely and complete evidence collection and review. • Collaborate with Sales, Legal, and Product teams to lead responses for customer security questionnaires and RFPs, progressively owning more complex requests as your experience deepens. • Maintain and continuously improve a centralized repository of commonly requested security documentation and artifacts (e.g., SOC 2, SIG, CAIQ). • Work closely with a broad array of business leaders to conduct initial and periodic vendor risk assessments, ensuring that third parties meet Rightway's security and compliance standards. • Track and follow up on remediation plans and risk treatment for vendors posing unacceptable risk. • Enable and support automation and optimization of the vendor risk assessment lifecycle using both AI and traditional tooling. • Support the implementation and operationalization of AI risk and governance controls in alignment with ISO/IEC 42001 (AI Management System) and emerging regulatory guidance e.g., CAIA (Colorado AI Act). • Monitor AI systems for compliance with ethical and legal standards.

• The Cybersecurity Analyst is responsible for the collection, analysis, validation, monitoring, and response to cybersecurity intelligence and events. • Perform day-to-day operational tasks by analyzing and responding to security events that have been logged and correlated by the SIEM or other security platform. • Monitor all in-place security solutions for efficient and appropriate operations. • Participate in investigation and resolution of anomalous activity. • Serve as a first responder and assist with initial investigations for potential security events. • Analyze configuration and vulnerability information to determine risk to the Bank’s data security. • Provide feedback on tuning of rules and alerts. Recommend tuning of rules that generate alerts to ensure low false positive rates.