Senior Security Control Assessor

This is a fully remote position, open to applicants in District of Columbia, +1 more state.

📋 Description

• Define and fulfill information assurance and security requirements based on user, policy, regulatory, and resource needs.

• Perform thorough evaluations of established controls and enhancements to those controls.

• Organize and facilitate System Assessments out-briefs with stakeholders.

• Offer SAP, SAR, security recommendations, and system certifications.

• Draft security, privacy, and supply chain assessment reports.

• Evaluate the seriousness of deficiencies and suggest corrective measures.

• Create and implement Security Controls Test plans, including vulnerability scans and penetration testing in accordance with DHS RVA standards.

• Generate final analysis reports, executive briefings for the CISO, AO briefing support, findings reports, and POA&M injection templates.

• Formulate or revise three-year OSA test plans utilizing NIST SP 800-53 control tests.

• Maintain OSA master project schedules using NIST assessment methodologies and approved OSA protocols.

• Develop or modify program management documentation, including rules of engagement, timelines, annual document reviews, and POA&M and accepted risk review procedures.

• Ensure vulnerability and penetration tests are planned, executed, analyzed, and presented to system owners and ISSOs.

• Collaborate with ISSOs, systems contractors, and the POAM Team to devise mitigation strategies and criteria for evidence.

• Populate FSA vulnerability tracking tool injection templates for security deficiencies.

• Review and provide guidance on Third Party Website and Applications (TPWA).

• Examine and assess system artifacts that support Authorization to Operate (ATO) requests.

• Deliver monthly OSA reports to the CISO that encompass assessment activities, reviews, audits, configuration management, tests, and residual risks.

• Offer enterprise risk ratings, identify trends, and propose security enhancements.

⛳️ Requirements

• Bachelor’s degree or equivalent with a minimum of ten (10) years of relevant experience.

• Senior industry certification such as CISSP or an equivalent credential is mandatory.

• At least five (5) years of experience as a Security Controls Assessor or in a similar role responding to audit findings.

• Exceptional communication and interpersonal abilities.

• Background in security audits and compliance.

• Experience handling IT Review Board change requests.

• Knowledge of government and agency policies and procedures, including FedRAMP, RMF, FISMA, FIPS-II, and NIST.

• U.S. Citizenship is required.

• Must be capable of obtaining a High Risk Public Trust Security Clearance.

• Active Secret or Top Secret security clearance is preferred.

🏝️ Benefits

• Certification incentive program.

• PTO.

• Options for floating federal holidays.

• HMO insurance plans.

• High Deductible health plans with Health Savings Accounts (HSAs).

• Flex Spending Accounts (FSAs).

• Comprehensive dental plans.

• Vision insurance.

• Short-term and long-term disability insurance.

• Life insurance.

• 401(k) matching.

• Flexible work environment.

• Support for professional development and rewards for obtaining new certifications.