Senior Cybersecurity & Compliance Advisor
SalaryNo pay range posted
LocationWashington, District of Columbia, United States
Work modehybrid
Typecontract
SenioritySenior
Experience8+ yrs
Company size12+ people
PostedAug 5, 2026 · 2mo ago
Verified live1d ago
At a glanceSummarised by Seekless from the posting.
Bachelor's degree in Cybersecurity, Information Assurance, Information Systems, Computer Science, Risk Management, or related discipline
Minimum 8 years of experience in cybersecurity, information assurance, security compliance, risk management, or federal cybersecurity programs
Demonstrated knowledge of FISMA, NIST RMF, and NIST SP 800-53 security controls
Experience reviewing security documentation, control evidence, risk assessments, authorization packages, or compliance artifacts
Ability to analyze cybersecurity risks and translate technical requirements into actionable recommendations
Strong written and verbal communication skills with the ability to engage technical and executive audiences
CISSP, CISM, CRISC, CAP/CGRC, Security+, or comparable cybersecurity certification
Experience supporting FISMA Moderate systems, federal authorization activities, or Authority to Operate (ATO) processes
Familiarity with cloud security practices, IAM, vulnerability management, DevSecOps, software supply-chain security, SBOM, SAST, and DAST processes
Experience supporting federal cybersecurity assessments, audits, inspections, continuous monitoring, or compliance programs
Experience working with federal agencies or government contractors in mission-critical environments
Ability to obtain and maintain client-required suitability requirements, including Public Trust eligibility if required
Ability to obtain and maintain client-required suitability clearance or Public Trust determination
Ability to support periodic onsite meetings in Virginia
Skills
NIST RMF
NIST SP 800-53
FISMA
SBOM
SAST
DAST
DevSecOps
About the role
Apogee is seeking an experienced Senior Cybersecurity & Compliance Advisor to provide cybersecurity governance, risk management, and compliance guidance supporting a federal simulation and analytics solution. This role will focus on security advisory, control assessment, authorization readiness, and risk mitigation while complementing the prime contractor’s hands-on DevSecOps and cybersecurity engineering teams.
The successful candidate will help ensure cybersecurity requirements, security controls, documentation, and authorization-readiness activities are integrated throughout the solution lifecycle, including design, development, testing, deployment, and transition.
This position requires a cybersecurity professional who can bridge technical security requirements with federal compliance expectations while effectively communicating risks and recommendations to technical teams, program leadership, and government stakeholders.
Key Responsibilities:
Cybersecurity Governance & Risk Advisory
•
Provide cybersecurity governance, risk, and compliance guidance throughout the program lifecycle.
•
Advise project teams on federal cybersecurity requirements, policies, and security best practices.
•
Support interpretation and implementation of FISMA Moderate requirements and NIST security controls.
•
Participate in cybersecurity risk assessments, technical design reviews, and security governance discussions.
•
Identify security gaps, residual risks, control deficiencies, and recommended mitigation strategies.
•
Communicate cybersecurity risks and compliance requirements to technical teams, leadership, and federal stakeholders.
Compliance & Authorization Support
•
Review security architectures, control implementations, security documentation, and technical evidence.
•
Support development and review of security documentation, including:
•
Security plans
•
Control narratives
•
Risk assessments
•
Plans of Action and Milestones (POA&Ms)
•
Authorization-readiness documentation
•
Support preparation activities for audits, security assessments, inspections, and authorization reviews.
•
Evaluate cybersecurity artifacts for completeness, accuracy, and alignment with federal compliance expectations.
•
Assist with continuous monitoring and ongoing authorization activities.
Security Engineering & Technical Review
•
Review cybersecurity practices related to:
•
Vulnerability management
•
Audit logging and monitoring
•
Identity and access management
•
Incident response
•
Configuration management
•
Provide guidance on software supply-chain security, including:
•
Software Bill of Materials (SBOM)
•
Static Application Security Testing (SAST)
•
Dynamic Application Security Testing (DAST)
•
Dependency analysis
•
Vulnerability remediation tracking
•
Collaborate with technical architects, DevSecOps engineers, program managers, and federal security stakeholders.
•
Support cybersecurity training, awareness, and knowledge-transfer activities.
Requirements
Qualifications:
•
Bachelor’s degree in Cybersecurity, Information Assurance, Information Systems, Computer Science, Risk Management, or related discipline.
•
Minimum 8 years of experience in cybersecurity, information assurance, security compliance, risk management, or federal cybersecurity programs.
•
Demonstrated knowledge of:
•
Federal Information Security Modernization Act (FISMA)
•
NIST Risk Management Framework (RMF)
•
NIST Special Publication 800-53 security controls
•
Experience reviewing security documentation, control evidence, risk assessments, authorization packages, or compliance artifacts.
•
Ability to analyze cybersecurity risks and translate technical requirements into actionable recommendations.
•
Strong written and verbal communication skills with the ability to engage technical and executive audiences.
•
Ability to obtain and maintain client-required suitability requirements, including Public Trust eligibility if required.
Preferred Qualifications:
Nice to have
•
CISSP, CISM, CRISC, CAP/CGRC, Security+, or comparable cybersecurity certification.
•
Experience supporting FISMA Moderate systems, federal authorization activities, or Authority to Operate (ATO) processes.
•
Familiarity with:
•
Cloud security practices
•
Identity and Access Management (IAM)
•
Vulnerability management
•
DevSecOps methodologies
•
Software supply-chain security
•
SBOM, SAST, and DAST processes
•
Experience supporting federal cybersecurity assessments, audits, inspections, continuous monitoring, or compliance programs.
•
Experience working with federal agencies or government contractors in mission-critical environments.
•
Security Requirement: Ability to obtain and maintain client-required suitability clearance or Public Trust determination.
•
Location Requirement: Candidates must be able to support periodic onsite meetings in Virginia.
Benefits
For any questions (OR) to apply, please contact us at [email protected]