Security Control Assessor

Location: Rockville, MD; primarily onsite

Company

Provides cybersecurity assessment support for federal information systems and authorization activities.

What you will do

• Conduct security control assessments in accordance with the NIST Risk Management Framework.
• Support federal Assessment & Authorization, Authorization to Operate, renewals, significant-change assessments, and continuous monitoring.
• Develop and execute Security Assessment Plans and prepare Security Assessment Reports.
• Review SSPs, SAPs, SARs, POA&Ms, risk assessments, contingency plans, vulnerability scans, and supporting evidence.
• Document findings, assess risk, validate corrective actions, and support closure of security deficiencies.
• Coordinate with system owners, engineers, ISSOs, cybersecurity teams, and government stakeholders.

Requirements

• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related field.
• 5+ years of cybersecurity or information security experience, including 3+ years of direct federal A&A, ATO, or NIST RMF experience.
• Hands-on Security Control Assessor experience and experience reviewing federal security authorization packages and technical security evidence.
• Strong knowledge of NIST SP 800-37, 800-53, 800-53A, and 800-30.
• Active CISSP or CISM certification required.
• Strong written and verbal communication skills.

Nice to have

• NIH, HHS, or other federal civilian agency experience.
• Experience with GRC platforms, FedRAMP or cloud environments, and tools such as Tenable, Nessus, Qualys, or Splunk.