Security Assessor

Accountabilities:

Cybersecurity Assessments: Conduct comprehensive assessments of management, operational, and technical security controls across information systems, networks, and software applications to evaluate compliance with NIST RMF and FedRAMP standards.
Cloud Security Evaluations: Assess the security posture of cloud-based environments, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) deployments.
Technical Security Analysis: Apply knowledge of IT infrastructure, hardware, software, applications, communications systems, and information processing environments to evaluate system security, integrity, and compliance.
Vulnerability and Configuration Assessments: Perform vulnerability assessments and security configuration reviews using automated scanning tools and manual assessment techniques.
Secure Development Practices: Evaluate Secure Software Development Lifecycle (SDLC) processes and DevSecOps practices to ensure security requirements are integrated throughout development and deployment activities.
Emerging Cybersecurity Technologies: Assess security considerations related to modern cybersecurity practices, including cloud security, Zero Trust architectures, artificial intelligence, and machine learning technologies.
Risk Identification and Remediation: Identify security weaknesses, document assessment findings, evaluate risk severity, and recommend appropriate remediation strategies to strengthen system security.
Authorization and Compliance Support: Support Authorization to Operate (ATO) processes, annual security assessments, continuous monitoring activities, and system reauthorization initiatives.
Stakeholder Collaboration: Work closely with ISSOs, system owners, authorizing officials, engineers, system administrators, and government stakeholders to validate security requirements and address assessment findings.
Security Documentation and Reporting: Review and prepare comprehensive security documentation, including Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
Regulatory Monitoring: Stay informed about emerging cybersecurity threats, federal security guidance, regulatory updates, and evolving compliance requirements to ensure assessments remain aligned with current standards.
Mission Support: Contribute to the protection of federal information systems by providing objective security evaluations and practical recommendations that support organizational cybersecurity objectives.
Requirements:
Bachelor's degree from an accredited college or university.
At least 7 years of professional experience supporting cybersecurity, information assurance, or Security Assessment and Authorization (A&A) activities.
Demonstrated experience applying the NIST Risk Management Framework (RMF) to federal information systems and security assessment processes.
Strong knowledge of federal cybersecurity frameworks, standards, and regulations, including:
NIST SP 800-53.
NIST SP 800-37.
Federal Information Security Modernization Act (FISMA).
Federal Risk and Authorization Management Program (FedRAMP).
Other applicable federal cybersecurity requirements and guidance.
Hands-on experience reviewing security documentation, assessing security controls, identifying vulnerabilities, and evaluating system compliance.
Familiarity with Security Assessment and Authorization processes, including ATO support, continuous monitoring, and security reauthorization.
Strong understanding of technical, operational, and management security controls across enterprise IT environments.
Experience with vulnerability scanning tools, security configuration assessments, cloud security, and assessment automation is an advantage.
Excellent analytical and problem-solving abilities, with the capacity to evaluate complex technical environments and translate findings into practical security recommendations.
Strong technical writing and documentation skills, including the ability to prepare clear, detailed security assessment reports.
Excellent verbal communication and stakeholder engagement skills, with the ability to collaborate effectively with technical teams and government representatives.
Ability to work independently, manage multiple assessment activities, and maintain high standards of accuracy and professionalism.
Preferred Qualifications:
Active cybersecurity certification such as CISSP, CISM, CISA, CASP+, or an equivalent industry-recognized credential.
Previous experience supporting federal cybersecurity contracts or government information security programs.
Experience with cloud security assessments, continuous monitoring solutions, vulnerability management, and automated security assessment tools.
CISA AES Assessment Lead (AL) or Technical Lead (TL) certification is desirable but not mandatory.
Must be willing and able to undergo the required federal background investigation and obtain and maintain a favorable Public Trust determination.
Must be a U.S. citizen, as indicated in the application requirements.
Military veterans with relevant cybersecurity, technical, or information assurance experience are strongly encouraged to apply.
Benefits:
Employment type: Full-time position.
Work arrangement: 100% remote, offering flexibility to work from home.
Competitive compensation based on professional experience, qualifications, and relevant expertise.
Professional development opportunities to support continued career growth.
Certification assistance and support for obtaining industry-recognized cybersecurity credentials.
Opportunities to work on meaningful federal cybersecurity initiatives and help protect critical government missions.
Collaborative working environment that encourages knowledge sharing, mentorship, and technical excellence.
Opportunities to learn from experienced cybersecurity professionals and contribute to developing future talent.
Veteran-friendly workplace that values military experience, leadership, and technical expertise.
Opportunity to contribute to innovative cybersecurity solutions within a mission-focused organization.