Cybersecurity Policy Analyst

Job overview

Cybersecurity Policy Analyst is a hybrid role with one to two onsite days per week in Bethesda, MD. The annual salary range is $95,000–$107,000. The analyst supports NIH OCIO’s Zero Trust Architecture Governance, Risk & Compliance task order as part of the Risk & Policy Pod. The role turns federal and HHS Zero Trust mandates into an enforceable NIH policy framework, connecting policy requirements to technical controls, evidence, and governance. It also supports policy communications and alignment with AI governance and data-management requirements.

What you'll do

• Develop NIH Zero Trust policy, standards, implementation guides, procedures, and an enterprise risk-management risk-appetite statement. Trace policy statements to federal and HHS sources and to controls, architecture patterns, and governance checkpoints. Inventory and benchmark policies against NIST, CISA, and threat frameworks
• produce a gap register and draft language. Develop policy anchors for identity, devices, networks, and data. Write policy briefs and monthly communications with the NIH ISAO Communications Team, conforming to Section 508
• align policy with AI governance and data-management requirements.

What we're looking for

Skills & competencies

cybersecurity policy analyst

hybrid

bethesda md

gunnison consulting group

$95k–$107k

zero trust architecture

federal cybersecurity

policy development

governance risk compliance

nist

section 508

nih ocio

public trust

u.s. citizenship required

Work arrangement

• Weekend coverage required

Benefits & perks

• Bonus and profit-sharing opportunities depending on performance
• three weeks of personal leave in the first year, 11 paid holidays, five days of flexible time off for approved training or certifications, 401(k) match, medical, dental, vision, life and disability insurance, public transportation subsidies, and up to $5,000 per year for certifications and training.

Why this role

Requires U.S. citizenship, 8+ years in federal cybersecurity policy, governance, or compliance, a bachelor’s degree, and Security+ or CAP/CGRC certification; ability to obtain and maintain Public Trust is required.

About the employer

Gunnison Consulting Group, Inc. is hiring for this role. Industry: Administrative Management and General Management Consulting Services. Sector: 54.