Security Controls Assessor (Cybersecurity)

Location: Washington, DC, United States; hybrid office arrangement with mostly CONUS and occasional OCONUS travel required

Salary: $150,000–$168,000

Company

hirify.global is the federal segment of Everforth, delivering technology solutions in data and AI, cybersecurity, and enterprise transformation for defense, intelligence, and federal civilian agencies.

What you will do

• Review and update information security policies, standards, and procedures against federal and departmental regulations.
• Conduct independent security and privacy control assessments for FISMA systems and subsystems in support of Security Assessment & Authorization.
• Review A&A packages, including SSPs, risk assessments, contingency plans, incident response plans, inventories, network diagrams, vulnerability reports, test reports, and POA&Ms.
• Develop and execute security and privacy assessment plans and control-level test cases across applications, servers, databases, operating systems, network devices, and end-user devices.
• Document system-specific findings and recommendations, and communicate control weaknesses and potential impacts to technical and non-technical stakeholders.
• Analyze security tool outputs to distinguish residual risk from false positives and conduct CONUS and OCONUS system assessments.

Requirements

• Active Secret clearance required, with eligibility to obtain Top Secret clearance.
• Bachelor’s degree in Computer Science, MIS/IT, Engineering, Information Security/Assurance, or a related field.
• At least five years of information security experience, including three years supporting security assessment teams as a senior team member.
• At least two years of experience using GRC tools and conducting full-scope technical security control testing.
• Working knowledge of RMF Steps 1–6, NIST SP 800-53 controls, the NIST Cybersecurity Framework, and applicable security and privacy laws.
• Strong written and verbal communication skills, including the ability to analyze configurations and present deficiencies clearly.

Nice to have

• Experience with A&A activities, risk assessments, security control assessments, and related documentation.
• Experience assessing systems hosted in AWS or Azure.
• Experience applying OMB, NIST, and FedRAMP policies, procedures, and standards.
• CISSP, CEH, CRISC, CISA, or AAIA certification.

Culture & Benefits

• Full-time, long-term contract supporting a U.S. Government civilian agency.
• Work within a mission-driven environment focused on delivery excellence, innovation, and professional growth.
• Benefits are available through hirify.global.
• Employment is contingent upon contract award.