Security Control Assessor

Zachary Piper Solutions is seeking a detail-oriented Security Control Assessor to evaluate and validate the security posture of systems and applications across our enterprise and client environments. The Security Control Assessor will ensure compliance with federal and industry standards by conducting thorough assessments, documenting findings, and recommending remediation strategies.

Responsibilities of the Security Control Assessor:

· Perform security control assessments in alignment with NIST RMF and other compliance standards

· Review system security plans, architecture diagrams, and supporting documentation for accuracy and completeness

· Conduct vulnerability scans, analyze results, and verify implementation of required security controls

· Prepare assessment reports, including findings, risk levels, and recommended corrective actions

Qualifications of the Security Control Assessor:

· 5+ years of hands-on experience working with security assessments, NIST 800-53 controls, and vulnerability analysis

· Strong understanding of NIST 800-53, RMF, and federal compliance requirements

· Experience with security assessment tools such as Nessus, SCAP, STIG Viewer, Xacta 360, or similar

· Vulnerability scanning and compliance tools (PowerShell, Ansible, Terraform)

· Ability to analyze technical documentation and identify gaps in security controls.

· Strong written and oral communication skills

· Preferred certifications: CAP (Certified Authorization Professional) , CISSP , Security+ , or CISA

· Must have an ACTIVE Secret Clearance

Compensation for the Security Control Assessor:

· Salary Range: Between $85,000 - $110,000 based on years of relevant experience

· Comprehensive Benefits: Medical, Dental, Vision, 401K, PTO, Paid Holidays, Sick Leave as required by law

This job opens for applications on 11/17/2025. Applications for this job will be accepted for at least 30 days from the posting date

Keywords:

Security control assessor, security control, cyber security, cybersecurity, access management, IAM, identity and access management, RBAC, role-based access control, privileged access management, PAM, authorization, authentication, least privilege principle, ACL, access control list, policy enforcement, active directory, LDAP, SAMl, OAuth, openID connect, MFA, multi-factor authentication, SSO, single sign-on, encryption, audit logging, ISO 27001, NIST, SOC 2, risk assessment, access review, security governance, security monitoring, incident response, OKTA, SIEM, SailPoint, Azure AD, cyberark, AWS IAM, CAP, certified authorization professional, CISSP, Sec+, security plus, security +, secret clearance, top secret clearance, top secret, cleared, federal, nessus, SCAP, STIG viewer, xacta 360, xacta, RMF, powershell, ansible, terraform,

#LI-BN1

#LI-ONSITE