Security Control Assessor
Core
Independently assess management, operational, and technical security controls for IT systems to determine effectiveness and compliance with federal standards.
Role type
Security Control Assessor (IC)
Builds
Security Assessment Plans (SAPs), control testing reports, and remediation recommendations for federal IT systems.
Domain
Federal Government / Cybersecurity Compliance
Required skills
NIST 800-37/800-53 compliance assessment, control testing and validation, risk determination, POA&M validation, ATO support, security control documentation, stakeholder communication, remediation tracking
Preferred skills
ACAS, Microsoft Defender, STIGs, Microsoft 365, SaaS security, RHEL, Windows Server, macOS, eMASS, NACLC Public Trust clearance
Technologies
macOS, Microsoft 365, RHEL, Windows, Office 365
Responsibilities
Develop Security Assessment Plans (SAPs), Conduct control testing and validation, Review system documentation and architectures, Assess cybersecurity risks and determine residual risk levels, Identify control deficiencies and recommend remediation actions, Validate Plans of Action and Milestones (POA&Ms), Support Authorization to Operate (ATO) decisions, Document findings and present results to system owners and officials, Track remediation efforts and reassessment activities
Seniority
Mid-level, hands-on IC
