WHAT DOES AN INFORMATION ASSURANCE ANALYST DO?

Published: Aug 25, 2025 - The Information Assurance Analyst supports security awareness initiatives, assists in resolving incidents with SOC and IT teams, and manages identity access systems and user access reviews. This role evaluates and documents security controls while collaborating across departments to enhance the organization’s cybersecurity posture. The analyst also engages with auditors, supports incident response, and ensures compliance with internal policies and procedures.

A Review of Professional Skills and Functions for Information Assurance Analyst

1. Information Assurance Analyst Duties

  • Information Analysis: Reviews information systems, transport systems, software, cyber security and datacenter infrastructure to provide information assurance and information security analysis
  • Policy Review: Review policies, procedures and guidance and provide analysis and reporting on the efficacy of all aspects of the current IA posture
  • Risk Mitigation: Provide recommendations on improvements, mitigations and remediation
  • Report Documentation: Document analysis findings and reports and share those findings collaboratively within the enterprise
  • Audit Preparation: Prepare the customer for Information Assurance inspections and audit reviews
  • Standards Implementation: Develops and implements information assurance/security standards and procedures
  • Requirements Analysis: Establishes and satisfies information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands
  • Policy Development: Supports customers at the highest levels in the development and implementation of doctrine and policies
  • Systems Security: Applies experience to government and commercial common user systems, as well as to dedicated special-purpose systems requiring specialized security features for system architectures
  • Security Design: Performs analysis, design, and development of security features for system architectures
  • Risk Analysis: Performs vulnerability/risk analysis of computer systems and applications during all phases of the system development life cycle
  • System Security: Ensures that all information systems are functional and secure
  • Regulation Compliance: Ensure compliance with regulations and privacy laws
  • Security Expertise: Recognized as a subject matter expert in Information Assurance
  • Workplace Communication: Utilizes strong communication, writing, and interpersonal skills throughout workplace performance

2. Information Assurance Analyst Details

  • Application Review: Supporting the software application review process for the OCIO application portfolio including mobile, SharePoint, .NET, and Salesforce applications
  • Risk Assessment: Evaluate findings, develop a risk assessment, and prepare recommendations to system owners for action
  • POA&M Tracking: Develop and track Plan of Action and Milestones (POA&Ms), including any waivers and associated documentation
  • Cyber Documentation: Develops cybersecurity documentation to support NIST RMF, assessment and authorization requirements to achieve and maintain an ATO
  • Scan Analysis: Analyze ACAS/SCAP scans and document results on a variety of systems to identify vulnerabilities and potential security issues for remediation to ensure STIG and IAVM compliance
  • Policy Enforcement: Ensures the integrity and protection of networks, systems, and applications by technical enforcement of organizational security policies, through monitoring of vulnerability scanning devices
  • Lifecycle Monitoring: Monitor the lifecycle of systems to verify the implementation of ongoing vulnerability assessment and remediation efforts by the system's Configuration Management Plan
  • Security Procedures: Review systems and develop applicable cybersecurity test procedures, execute applicable best security practices, and monitor and implement policies and guidance to mitigate cybersecurity risk to the systems
  • System Assessment: Collaborate with system administrators to conduct compliance and vulnerability assessments of systems utilizing automated DoD cybersecurity tools, Assured Compliance Assessment Solution (ACAS), SCAP Compliance Checker (SCC), and DISA STIG Viewer

3. Information Assurance Analyst Responsibilities

  • A&A Coordination: Perform comprehensive A&A tasks including package development, controls analysis, risk assessment, contingency planning, security test and evaluation, risk mitigation analysis, and technology assessments
  • Stakeholder Engagement: Coordinate with facilities, operations, biomedical equipment, and other departments within the medical command to spearhead and facilitate completion of A&A packages
  • Standards Compliance: Utilize the application of NIST and FIPS standards and guidance documents to register and complete accreditation packages in the DISA eMASS system
  • RMF Management: Lead the RMF accreditation lifecycle for assigned systems from cradle to grave, managing stakeholder engagement, lifecycle progression, schedule development, accreditation package review, submission and validation
  • System Support: Maintain and support current and ongoing A&A packages to ensure an uninterrupted delivery of information technology systems for the organization
  • Policy Documentation: Create, manage, and maintain setup documentation and security policies for compliance and accreditation purposes for all programs, including SOPs, Policies, Procedures, Plans, etc.
  • Assessment Reporting: Report on assessment process status, participate in Independent Verification and Validation (IV&V) activities, conduct/oversee IV&V testing and assist system certifiers during evaluations
  • Template Development: Develop and maintain organizational cybersecurity templates, policies, and procedures
  • Training Support: Assist in leading training sessions provided by the division to the greater organization and preparing related training materials

4. Information Assurance Analyst Job Summary

  • Security Training: Assists in the Security Awareness and Training Program efforts by working closely with lines of business (LOB) to help identify top risks related to employees that may lead to compromise and exfiltration of sensitive information
  • Policy Enforcement: Provides and requires additional training that includes acceptable use and the consequences of non-compliance
  • Incident Handling: Assists in resolving service desk security emails and escalates security incidents by coordinating and collaborating with the SOC (Security Operations Center), Help Desk, IT, Risk teams and LOBs to remediate identified risks and vulnerabilities
  • Access Management: Assists in the Identity Access Management Program efforts by serving as IDAM System Analyst and completes daily processing, upkeep, configuration, and operation of the IDAM System
  • Access Reviews: Conducts User Access Reviews (UARs) for critical, SOX and GLBA-covered applications and others
  • Audit Interface: Interfaces with both internal and external auditors and examiners
  • Incident Response: Serves as an additional information security team member, aiding in incident response (IR) with the IR and SOC teams
  • Risk Identification: Works independently and collaboratively to identify information security risks and improve the overall security posture of the organization
  • Solution Testing: Evaluates, tests, and documents security solutions and controls
  • Team Collaboration: Collaborates with other internal security experts and departments to ensure the protection of sensitive information
  • Judgment Application: Regularly exercises discretion and judgment in the performance of essential job functions
  • Work Discipline: Maintains good punctuality and attendance at work
  • Policy Compliance: Follows Bank policy, procedure, and guidelines

5. Information Assurance Analyst Accountabilities

  • Risk Management: Implement Risk Management Framework (RMF) guidance within Intelligence Community (IC) environments
  • System Assessment: Perform assessments of systems and networks, identify where those systems and networks deviate from policy, and document findings
  • Program Control: Establish strict program control processes to ensure mitigation of risks to support obtaining certification and accreditation of systems
  • Policy Implementation: Assist in the implementation of the required government policy
  • Process Tailoring: Make recommendations on process tailoring
  • Stakeholder Collaboration: Collaborate with stakeholders to reach secure outcomes
  • Security Analysis: Perform analyses to validate established security requirements and to recommend additional security requirements and safeguards
  • Certification Documentation: Document the results of Certification and Accreditation (C&A) activities
  • Security Planning: Prepare System Security Plans (SSP)
  • Action Tracking: Update the Plan of Actions and Milestones (POA&M)
  • Audit Review: Periodically conduct a complete review of each system's audits and monitor corrective actions until all actions are closed

6. Information Assurance Analyst Functions

  • Security Monitoring: Perform information systems security (ISS) monitoring and event detection for FAA National Airspace System (NAS) assets
  • Data Analysis: Monitor numerous sources of collected security data including system security event logs, system Internet Protocol (IP) data flows, Intrusion Detection System (IDS) alerts and payload, and system performance monitoring services
  • Event Coordination: Coordinate with other NAS monitoring entities to obtain all required event information and full situational awareness
  • Ticket Management: Establish and maintain security event tickets throughout the event lifecycle
  • Incident Response: Coordinate with applicable stakeholders to develop security event remediation strategies and timelines
  • Event Communication: Conduct security event telephone conferences to provide situational awareness to appropriate entities
  • Event Reporting: Perform upward reporting activities for events
  • Threat Intelligence: Coordinate with the FAA Intelligence Organizations to obtain relevant external threat intelligence from various sources via secure means as required by information classification
  • Intelligence Processing: Process acquired intelligence into actionable information that has relevance to NAS operations and defines any required mitigation actions
  • Exercise Support: Support cyber security Tabletop Exercises (TTX) on-site and remotely and participate in After Action Reviews (AAR)

7. Information Assurance Analyst Job Description

  • Security Compliance: Review violations of computer security procedures to eliminate violations
  • Team Leadership: Provide work leadership for lower-level employees
  • Requirements Analysis: Assist in the discovery of the systems' protection needs and definition of system security requirements, design of system security architectures, development of security designs, implementation of security systems, and in the assessment of the effectiveness of information protection
  • System Integration: Assist the government in ensuring cybersecurity is an integrated part of systems engineering and the security and IA solutions are effective and efficient
  • Security Review: Assist the government in executing full security engineering and review services while meeting all IA requirements respective to confidentiality, integrity, and availability
  • Traffic Analysis: Rapidly assess network traffic, detect data anomalies, and provide detailed reports
  • Alert Mitigation: Provide alert handling mitigation strategies to other Subject Matter Experts, clients, and project managers
  • Risk Assessment: Ensure the successful performance of vulnerability and risk analyses of computer systems and applications during all phases of the system development life cycle
  • Incident Response: Conduct basic incident response and provide recommendations and technical support
  • Audit Support: Conduct cybersecurity-related audits, inspections, vulnerability assessments, compliance assessments, and Security Readiness Review (SRR)
  • Evaluation Compliance: Ensure compliance with Cyber Security Service Provider (CSSP) and Command Cyber Readiness Inspection (CCRI) evaluation criteria

8. Information Assurance Analyst Overview

  • Cyber Strategy: Ensure the incorporation of industry best practices throughout the Cyber program, which consists of defending the IT environment from cyber threats
  • Threat Detection: Detect compromises, weaknesses and incidents
  • Incident Response: Respond to those events to prevent further damage
  • Control Adoption: Participate in the effort to adopt and institutionalize the Twenty Critical Security Controls for Effective Cyber Defense - Consensus Audit Guidelines (CAG)
  • Cyber Planning: Provide cybersecurity planning, reporting and implementation consistent with NETL, Under Secretary, and Departmental policies and requirements
  • System Accreditation: Provide support related to establishing and/or maintaining the certification and accreditation of IT systems and applications within the appropriate NETL boundaries or enclaves using the risk management approach outlined in DOE Order 205.1 B and the Undersecretary of Energy PCSP
  • Access Management: Ensure that users are granted access to information systems’ resources based on the least privilege required principle
  • Requirement Documentation: Document any special protection requirements identified by the application owner, data owner, or data steward
  • Protection Measures: Ensure that these requirements are included within the protection measures implemented in the information system
  • System Notification: Ensure that the organization’s Cyber Security Program Manager (CSPM) is notified when an IT system or application is no longer needed or when changes occur that might affect its accreditation
  • Security Training: Ensure that users and systems administrators are properly trained in information system security
  • Security Audits: Continuously conduct cybersecurity audits, reviews and tests to ensure that the cybersecurity features and controls are functioning and effective
  • Security Posture: Ensure the appropriate operational security posture is maintained for IT systems and applications
  • Risk Documentation: Document residual risk and mitigation measures such that the Approving Authority (AO) or the Approving Authority Designated Representative (AODR) can make/decision relative to the acceptability of risk and the resultant impact on an authority to operate
  • Compliance Management: Ensure compliance with all Program Cyber Security Plan requirements and documentation, including but not limited to network connections, security impact analyses, change control, and Plan of Action and Milestones (POA&M)
  • Cloud Support: Help support and deploy cloud initiatives and services within the company, around the processes
  • DevOps Methodology: Support and use current methodologies such as Agile and Dev/Ops as the Cyber leader

9. Senior Information Assurance Analyst Details and Accountabilities

  • Workstation Support: Support virtual and physical workstation configurations
  • Meeting Participation: Attend and support ISSO, ISSM and RMF meetings
  • Document Review: Review the PSO checklist documents
  • Workflow Monitoring: Monitor and report the status of eMASS packages for pending workflows
  • Workflow Management: Fulfill the eMASS Information System Owner role and initiate eMASS workflows
  • Scan Reporting: Provide reports on scans in VRAM
  • Compliance Reporting: Create and distribute VRAM compliance reports and update VRAM questionnaires and compliance reports
  • EXORD Updates: Provide updates on EXORDs and perform compliance reporting
  • MFR Tracking: Track MFRs for RMF packages in support of ISSM
  • Access Maintenance: Maintain ISSO eMASS access roles
  • System Registration: Register systems in VRAM

10. Senior Information Assurance Analyst Tasks

  • Task Prioritization: Organize and prioritize items requiring ISSM attention
  • Documentation Support: Assist with the development of system cybersecurity documentation
  • Requirements Management: Provide cybersecurity requirements management support to systems owners, government managers, and other stakeholders
  • Vulnerability Response: Assist ISSOs in responding to Information Assurance Vulnerability Alerts (IAVAs) and EXORDs to address system vulnerabilities
  • Dashboard Development: Build ISSM/leadership cybersecurity status dashboards
  • Event Coordination: Manage agenda, feedback, and attendance certificates for cybersecurity all-hands events
  • Incident Tracking: Incident response tracking for ISSM
  • Authorization Updates: Track and provide cybersecurity authorization updates to the network provider
  • Compliance Monitoring: Track Risk Management Framework continuous monitoring compliance
  • Security Representation: Represent ISSM on Security Assist Visits