Security Control Assessor

• Conduct comprehensive security control assessments of DoD information systems in accordance with NIST SP 800-53, DoD RMF policies, CNSSI 1253, and the JSIG.
• Evaluate the implementation and effectiveness of security controls and document assessment findings, risks, deficiencies, and recommended corrective actions.
• Communicate government-approved mitigation and remediation requirements to system owners, cybersecurity personnel, and technical stakeholders in support of the RMF process.
• Apply the cybersecurity principles of confidentiality, integrity, and availability when evaluating system categorization and impact levels, including High, Moderate, and Low classifications.
• Validate security controls identified as inherited from hosting environments, connected systems, enterprise services, or other authorized systems.
• Assess program compliance with security controls associated with registered Ports, Protocols, and Services, including the proper generation, retention, protection, and handling of system log files.
• Review system security documentation and supporting evidence for accuracy, completeness, consistency, and alignment with applicable cybersecurity requirements.
• Lead the review, preparation, and quality assurance of Authorization to Operate packages and related RMF documentation.
• Identify control gaps, weaknesses, and areas of noncompliance and provide clear, actionable recommendations for remediation.
• Coordinate with system owners, information system security personnel, engineers, program leadership, and government stakeholders throughout the assessment and authorization lifecycle.
• Support the development, review, and validation of Plans of Action and Milestones and other risk-management documentation.
• Provide leadership and technical guidance to assessment teams and support the resolution of complex cybersecurity compliance issues.

Requirements

• Bachelor’s degree in cybersecurity, information technology, computer science, information systems, engineering, or a related field.
• Eight or more years of professional experience in cybersecurity.
• Five or more years of experience supporting Certification and Accreditation or Assessment and Authorization activities.
• Expert-level knowledge of the DoD Risk Management Framework.
• Strong working knowledge of NIST SP 800-37, NIST SP 800-53, CNSSI 1253, and the JSIG.
• Experience conducting security control assessments and evaluating technical, operational, and management controls.
• Experience reviewing and preparing ATO packages and supporting documentation.
• Experience validating inherited controls and assessing Ports, Protocols, and Services requirements.
• Demonstrated leadership experience, including previous experience serving in a lead or senior assessment role.
• Strong written and verbal communication skills, with the ability to clearly explain technical findings, risks, and remediation requirements to system owners and government stakeholders.

• Experience supporting DoD Special Access Programs or other highly classified environments.
• Experience working directly with system owners, ISSOs, ISSMs, security engineers, and Authorizing Official representatives.
• Familiarity with security assessment reports, risk assessment reports, system security plans, POA&Ms, and continuous-monitoring documentation.
• Experience leading assessment teams or overseeing multiple system authorization efforts.