Security Control Assessor

This is a fully remote position, open to applicants in District of Columbia, +2 more states.

📋 Description

• Deliver comprehensive subject matter expertise in Security Authorization (SA) and Organizational Security Authorization (OSA) for the Information System Security and Authorization program.

• Offer guidance and technical insight through established standards, policies, procedures, and oversight of programs.

• Evaluate and provide recommendations on OSA program and continuous monitoring capabilities, as well as Privacy Impact Assessments (PIAs), System Security Plans (SSPs), and identity updates.

• Assess and provide counsel on Privacy Impact Assessments (PIAs).

• Evaluate and advise on Third Party Websites and Applications (TPWA).

• Examine system artifacts for accuracy and completeness to support Authorization to Operate (ATO) requests.

• Review and either create or update Risk Management Framework (RMF) ATO packages for customer and partner systems.

• Prepare or review ATO packages prior to submission for CISO and CIO approval.

• Upload assessment and audit reports to the FISMA Management Tool (CSAM).

• Coordinate data collection efforts and calls for audit and compliance reporting.

• Conduct audits of closed Plans of Actions and Milestones (POA&M) for completeness and compliance.

• Assist in the ongoing security authorization process, including continuous monitoring.

• Provide document development support for events and responses sponsored by the CISO.

• Draft document reviews and feedback on security and privacy requirements, covering technical review boards, SSPs, risk assessments, contingency plans, and POA&M reports.

• Monitor security authorization renewal dates and manage renewal efforts with stakeholders, Security Officers, and Information System Security Officers (ISSOs).

• Facilitate lessons-learned sessions and formulate best practices.

⛳️ Requirements

• Bachelor’s degree or equivalent and five to ten (5-10) years of relevant experience.

• Senior-level industry certification such as CISSP or an equivalent qualification.

• Minimum of three years of experience in a computer security incident response role.

• At least three years of experience in enterprise Linux and Windows administration.

• Experience in a Security Operations Center.

• Proficiency with Active Directory and other enterprise credential management systems.

• Familiarity with cyber threat intelligence.

• Strong communication and interpersonal skills.

• Excellent critical thinking and problem-solving abilities.

• Capacity to swiftly learn new technologies and adapt to evolving requirements and environments.

• Ability to work autonomously as well as collaboratively in a cross-functional team.

• Skill in identifying both tactical and strategic solutions to complex issues.

• Advanced experience in malware analysis, including reverse engineering and disassembly design.

• Must be a U.S. citizen.

• Must be eligible to obtain High Risk Public Trust Security Clearance.

🏝️ Benefits

• Certification incentive program.

• Paid time off (PTO).

• Options for floating federal holidays.

• Health insurance plans, including HMO and High Deductible options.

• Health Savings Accounts (HSAs).

• Flexible Spending Accounts (FSAs).

• Comprehensive dental plans.

• Vision insurance.

• Short-term and long-term disability insurance.

• Life insurance coverage.

• 401(k) plan with employer matching contributions.

• Flexible work environment.

• Recognition and rewards for professional development and obtaining relevant business certifications.