Cybersecurity & Compliance Advisor

Apogee is seeking an experienced Senior Cybersecurity & Compliance Advisor to provide cybersecurity governance, risk management, and compliance guidance supporting a federal simulation and analytics solution. This role will focus on security advisory, control assessment, authorization readiness, and risk mitigation while complementing the prime contractor’s hands-on DevSecOps and cybersecurity engineering teams.

The successful candidate will help ensure cybersecurity requirements, security controls, documentation, and authorization-readiness activities are integrated throughout the solution lifecycle, including design, development, testing, deployment, and transition.

This position requires a cybersecurity professional who can bridge technical security requirements with federal compliance expectations while effectively communicating risks and recommendations to technical teams, program leadership, and government stakeholders.

Key Responsibilities:

Cybersecurity Governance & Risk Advisory

• Provide cybersecurity governance, risk, and compliance guidance throughout the program lifecycle.
• Advise project teams on federal cybersecurity requirements, policies, and security best practices.
• Support interpretation and implementation of FISMA Moderate requirements and NIST security controls.
• Participate in cybersecurity risk assessments, technical design reviews, and security governance discussions.
• Identify security gaps, residual risks, control deficiencies, and recommended mitigation strategies.
• Communicate cybersecurity risks and compliance requirements to technical teams, leadership, and federal stakeholders.

Compliance & Authorization Support

• Review security architectures, control implementations, security documentation, and technical evidence.

• Support development and review of security documentation, including:

• Security plans

• Control narratives

• Risk assessments

• Plans of Action and Milestones (POA&Ms)

• Authorization-readiness documentation

• Support preparation activities for audits, security assessments, inspections, and authorization reviews.

• Evaluate cybersecurity artifacts for completeness, accuracy, and alignment with federal compliance expectations.

• Assist with continuous monitoring and ongoing authorization activities.