Senior Security Control Assessor
Core
Establish information assurance and security requirements, assess implemented controls, and produce security assessment reports and recommendations for federal systems.
Role type
Senior Security Control Assessor
Builds
Security assessment reports, test plans, and authorization packages for federal systems
Domain
Federal government cybersecurity and compliance
Required skills
Security controls assessment, security audits, compliance (FedRAMP, RMF, FISMA, FIPS-II, NIST), IT Review Board change requests, vulnerability scanning, penetration testing, risk rating, POA&M management
Preferred skills
Active Secret or Top Secret security clearance, Senior-level industry certification (CISSP)
Technologies
Security SAP, NIST SP 800-53, FSA vulnerability tracking tools
Responsibilities
Establish information assurance and security requirements based on user needs, policies, and regulations. Assess implemented controls to determine if they meet security and privacy requirements. Schedule and lead system assessment out-briefs with stakeholders. Develop and execute Security Controls Test plans aligned with DHS RVA standards. Produce assessment deliverables including final analysis reports and CISO executive briefings. Create or update three-year OSA test plans using NIST SP 800-53 control tests. Ensure vulnerability and penetration tests are scheduled, conducted, and analyzed. Coordinate with ISSOs and contractors to develop mitigation strategies for deficiencies. Review system artifacts for accuracy in support of authorization to operate (ATO) requests. Rate risk across systems and recommend enterprise security improvements.
