Business Analyst / ATO Support Analyst

The Data Management Center (DMC) Application Development and Sustainment project provides enterprise software development, modernization, and data governance support for the U.S. Department of Veterans Affairs (VA) Office of Academic Affiliations (OAA). The program sustains and modernizes a portfolio of approximately twelve custom-built .NET web applications, Microsoft Power Platform solutions, SharePoint sites, SSRS and Power BI reports, and supporting SQL Server databases that enable OAA's health professions education, Advanced Fellowship, and trainee management mission. Work includes migration to the VA Enterprise Cloud (VAEC) using Microsoft Azure, SSRS-to-Power BI and WebForms-to-ASP.NET Core modernization, enterprise data governance toward Level 4-5 CMMI target operating maturity, Section 508 accessibility compliance, and continuous sustainment of the active VA-wide umbrella ATO (FIPS 199 Moderate). DMC personnel support both day-to-day operations and strategic modernization initiatives in alignment with VA policies, VAEC standards, and Government-approved governance processes. All work is performed at the Contractor's facility. 

The Business Analyst / ATO Support Analyst aligns as an L3 Senior Consultant position at 9th Way Insignia. The position supports the VA Office of Academic Affiliations Data Management Center (DMC). This role supports business requirements gathering, system documentation, and ATO maintenance for the DMC application portfolio under the active VA-wide umbrella ATO (FIPS 199 Moderate). All OAA applications operate under a single active umbrella ATO; no initial authorization is required, and ATO work focuses on sustainment and documentation upkeep. The Business Analyst / ATO Support Analyst serves as the bridge between Government stakeholders and the technical development team, translating business needs into actionable requirements and ensuring security and compliance artifacts remain current, accurate, and complete. 

• Elicit, analyze, and document business requirements from OAA stakeholders and translate them into actionable technical requirements. 
• Serve as the bridge between Government stakeholders, the Program Manager, and the development team. 
• Maintain ATO artifacts, including System Security Plan (SSP) updates, control narratives, POA&M tracking, and scan evidence. 
• Ensure ATO artifacts remain current within timeframes specified by the VA Information Security Knowledge Service. 
• Support sustainment of the active VA umbrella ATO (FIPS 199 Moderate) throughout the period of performance. 
• Develop and maintain system documentation, process flows, wireframes, site diagrams, and user-facing job aids. 
• Support Section 508 compliance documentation and accessibility conformance reporting. 
• Track and report on requirements, deliverables, and compliance status; contribute to the Quarterly Progress Report. 
• Coordinate with the Data Governance / Data Manager on data definitions and reporting requirements. 
• Participate in recurring working sessions and ad-hoc meetings with OAA leadership and VA stakeholders. 

• Bachelor's degree in Business Administration, Information Systems, Computer Science, or a related field. No equivalencies or substitutions for the degree requirement will be accepted. 
• Four (4) or more years of experience in business analysis, system documentation, and security compliance support. 
• Familiarity with VA ATO/RMF processes and NIST security standards. 
• Demonstrated experience maintaining security compliance artifacts (SSP, POA&M, control narratives). 
• Strong written communication and stakeholder-facing skills. 
• Must have resided continuously in the United States for the past 36 months. 
• U.S. Citizenship required. 

Preferred/Desired 

• Security or audit-related certifications (e.g., CISSP, CAP, Security+). 
• Direct experience with VA ATO processes and the VA Information Security Knowledge Service. 
• Experience supporting federal agencies or large enterprise environments. 
• Familiarity with Agile delivery methods and Azure DevOps. 
• Experience with Section 508 conformance documentation (ACR/VPAT).