Senior Cloud Security Assessor
Core
Lead full-cycle Security Assessment and Authorization (SA&A) activities for cloud, hybrid, and enterprise systems as an independent assessor, focusing on Microsoft Azure and AWS environments.
Role type
Senior independent cloud security assessor
Builds
Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), Required Evidence Lists, and Plans of Action and Milestones (POA&Ms)
Domain
Federal government cybersecurity, cloud infrastructure (AWS, Azure), and compliance (FedRAMP, NIST RMF)
Required skills
CISSP certification, cloud security control assessment, FedRAMP authorization package analysis, NIST RMF processes, vulnerability risk management, security architecture analysis, technical writing, stakeholder communication
Preferred skills
CCSK, CCSP, CGRC, federal cybersecurity program support, privacy and data protection assessment, DoD 8570/8140 IAM Level II eligibility
Technologies
AWS, Azure, Cloud, IAM, Network Security
Responsibilities
Assess implementation and operating effectiveness of administrative, operational, and technical security controls in Azure and AWS; retrieve and review FedRAMP authorization packages and supporting documentation; examine assessment evidence including system security plans, policies, procedures, and configurations; develop SAPs, SARs, RARs, Required Evidence Lists, and POA&Ms; test network, system, application, and NIST security controls; analyze vulnerability scan results and evaluate risk; communicate findings, risk, root causes, and feasible mitigation options to technical teams, system owners, executives, and other stakeholders; coordinate evidence requests, interviews, testing, and assessment schedules with customer personnel and Information Systems Security Analysts; support security assessment program operations and contribute to consistent methods, quality reviews, and defensible reporting
