Senior Cybersecurity & Compliance Advisor

About the role

Apogee is seeking an experienced Senior Cybersecurity & Compliance Advisor to provide cybersecurity governance, risk management and compliance guidance for a federal simulation and analytics solution. The role complements the prime contractor's hands-on DevSecOps and cybersecurity engineering teams, ensuring security requirements, controls, documentation and authorization-readiness activities are integrated across design, development, testing, deployment and transition. It calls for someone who can bridge technical security needs with federal compliance expectations and communicate risks to technical teams, program leadership and government stakeholders.

Key responsibilities

• Cybersecurity governance and risk advisory: advise project teams on federal cybersecurity requirements and best practices, support FISMA Moderate and NIST RMF 800-53, take part in risk assessments and design reviews, and identify gaps and mitigation strategies.
• Compliance and authorization support: review security architectures, controls and documentation, support security plans, control narratives, risk assessments, POA&Ms and authorization-readiness documents, and prepare for audits, assessments, inspections and authorization reviews.
• Security engineering and technical review: guide vulnerability management, audit logging, IAM, incident response and configuration management, and advise on software supply-chain security (SBOM, SAST, DAST, dependency analysis).
• Collaborate with technical architects, DevSecOps engineers and program managers, and support cybersecurity training and knowledge transfer.

Required profile

• Bachelor's degree in Cybersecurity, Information Assurance, Information Systems, Computer Science, Risk Management or a related discipline.
• Minimum 8 years of experience in cybersecurity, information assurance, security compliance, risk management or federal cybersecurity programs.
• Ability to obtain and maintain client-required suitability requirements, including Public Trust eligibility if required.
• Location: candidates must be able to support periodic onsite meetings in Virginia.

Required skills

• FISMA, NIST RMF and NIST SP 800-53 security controls
• Experience reviewing security documentation, control evidence, risk assessments and authorization packages
• Preferred: CISSP, CISM, CRISC, CAP/CGRC, Security+ or comparable certification
• Preferred: experience with FISMA Moderate systems, ATO processes, cloud security, IAM, DevSecOps and SBOM/SAST/DAST