Job Requirements
Remote
Secret Polygraph not specified
Mid Level Career (5+ yrs experience)
$120,000 - $140,000
Job Description
Senior Security Control Assessor
Location: Remote (occasional travel required)
Clearance: Active Secret clearance required
About the Role
We are seeking a Senior Security Control Assessor to support a federal customer’s cybersecurity assessment and authorization program. In this role you will lead independent security control assessments across complex and emerging technology environments, including cloud, operational technology (OT), legacy, and AI-enabled systems. You will produce authorization packages and give Authorizing Officials a clear, defensible basis for risk decisions.
Key Responsibilities
Lead independent security control assessments in CSAM or JCAM, tailoring NIST SP 800-53 controls to each system’s architecture, boundaries, and risk profile
Develop Security Assessment Plans (SAPs) with defined scope, testing methods, and rules of engagement
Conduct control testing (examine, interview, test) and document concrete findings in Security Assessment Reports (SARs)
Draft and maintain POA&Ms with realistic remediation milestones and timelines
Prepare and finalize authorization packages for full ATO, ATP, ATU, and conditional ATO decisions, and recommend an authorization outcome to the Authorizing Official (AO)
Execute Risk Assessment Methodologies (RAMs), scoring risk by likelihood and impact
Collect and validate primary evidence before system kickoff, including configuration baselines, policy documents, and automated scan results
Lead kickoff meetings with system owners to confirm scope, testing expectations, and evidence needs
Adapt assessment procedures for cloud and AI-integrated systems, leveraging FedRAMP and CSP documentation and shared responsibility models
Evaluate specialized risks such as data privacy in AI models and physical/logical boundaries in OT environments
Maintain rigorous assessment artifacts that withstand federal audit and oversight review
Resolve disputes over high-severity findings and critical POA&M designations using technical evidence, NIST control interpretation, and compensating control analysis, escalating unresolved issues through established risk governance channels
Serve as a subject matter expert, mentoring junior assessors and reviewing their work products for quality and consistency
Required Qualifications
Active Secret clearance (required at time of application)
7–10+ years of experience in cybersecurity, including 5+ years performing independent security control assessments in a federal environment
Hands-on experience with CSAM and/or JCAM
Strong working knowledge of the NIST Risk Management Framework (RMF), NIST SP 800-53 (Rev. 5), and SP 800-53A assessment procedures, including control tailoring
Demonstrated experience authoring SAPs, SARs, and POA&Ms for full ATO packages
Experience assessing cloud environments, with familiarity with FedRAMP and shared responsibility models
Proven ability to defend assessment findings to system owners and senior stakeholders
Excellent written and verbal communication skills, with the ability to brief technical and executive audiences
Bachelor’s degree in a related field, or equivalent experience
Active certification such as CISSP, CISA, CAP, or equivalent, if required by the client
Preferred Qualifications
Experience assessing OT/ICS, legacy, or AI/ML-enabled systems
Prior DHS experience
Familiarity with the NIST AI RMF and emerging federal AI security guidance
Location: Remote (occasional travel required)
Clearance: Active Secret clearance required
About the Role
We are seeking a Senior Security Control Assessor to support a federal customer’s cybersecurity assessment and authorization program. In this role you will lead independent security control assessments across complex and emerging technology environments, including cloud, operational technology (OT), legacy, and AI-enabled systems. You will produce authorization packages and give Authorizing Officials a clear, defensible basis for risk decisions.
Key Responsibilities
Lead independent security control assessments in CSAM or JCAM, tailoring NIST SP 800-53 controls to each system’s architecture, boundaries, and risk profile
Develop Security Assessment Plans (SAPs) with defined scope, testing methods, and rules of engagement
Conduct control testing (examine, interview, test) and document concrete findings in Security Assessment Reports (SARs)
Draft and maintain POA&Ms with realistic remediation milestones and timelines
Prepare and finalize authorization packages for full ATO, ATP, ATU, and conditional ATO decisions, and recommend an authorization outcome to the Authorizing Official (AO)
Execute Risk Assessment Methodologies (RAMs), scoring risk by likelihood and impact
Collect and validate primary evidence before system kickoff, including configuration baselines, policy documents, and automated scan results
Lead kickoff meetings with system owners to confirm scope, testing expectations, and evidence needs
Adapt assessment procedures for cloud and AI-integrated systems, leveraging FedRAMP and CSP documentation and shared responsibility models
Evaluate specialized risks such as data privacy in AI models and physical/logical boundaries in OT environments
Maintain rigorous assessment artifacts that withstand federal audit and oversight review
Resolve disputes over high-severity findings and critical POA&M designations using technical evidence, NIST control interpretation, and compensating control analysis, escalating unresolved issues through established risk governance channels
Serve as a subject matter expert, mentoring junior assessors and reviewing their work products for quality and consistency
Required Qualifications
Active Secret clearance (required at time of application)
7–10+ years of experience in cybersecurity, including 5+ years performing independent security control assessments in a federal environment
Hands-on experience with CSAM and/or JCAM
Strong working knowledge of the NIST Risk Management Framework (RMF), NIST SP 800-53 (Rev. 5), and SP 800-53A assessment procedures, including control tailoring
Demonstrated experience authoring SAPs, SARs, and POA&Ms for full ATO packages
Experience assessing cloud environments, with familiarity with FedRAMP and shared responsibility models
Proven ability to defend assessment findings to system owners and senior stakeholders
Excellent written and verbal communication skills, with the ability to brief technical and executive audiences
Bachelor’s degree in a related field, or equivalent experience
Active certification such as CISSP, CISA, CAP, or equivalent, if required by the client
Preferred Qualifications
Experience assessing OT/ICS, legacy, or AI/ML-enabled systems
Prior DHS experience
Familiarity with the NIST AI RMF and emerging federal AI security guidance
group id: 91086984