Job Description
Salary: $140,000 - 160,000 per year Requirements:
- Strong understanding of the Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137
- Extensive hands-on expertise with FISMA systems, NIST 800-series guidance, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework tools, POA&M policies, and vulnerability/patch management
- Proficiency with vulnerability and scanning tools, including the ability to interpret risk posture from assessment results
- Experience in project management, tracking, and Microsoft Word, Excel, and PowerPoint
- Experience assessing cloud security authorizations, including FedRAMP, AWS, and Azure, along with NIST control responsibilities
- Experience with SAP/JSIG
- Strong experience documenting and reviewing security artifacts such as SSPs, SARs, SAPs, and related NIST 800-series documents
- Experience creating Security Assessment Plans, Security Assessment Reports, and executive-level briefings
- Bachelors degree in Computer Science or a related technical field
- Masters degree preferred
- 6-10 years of experience
- Active TS/SCI clearance with the ability to obtain and maintain a CI polygraph
- DOD 8140 IAM Level II certification required (CAP, CASP, CISM, CISSP, GSLC, or CCISO)
- Systems Security Engineering background preferred
- Strong communication, analytical, and organizational skills, including the ability to work across teams, identify vulnerabilities, and prioritize multiple tasks
- Comprehensive senior-level knowledge of RMF activities and familiarity with federal regulatory requirements, contractual obligations, and industry standards such as Privacy, GDPR, and HIPAA
Responsibilities: - Advise the Information System Owner on confidentiality, integrity, and availability impact levels for system information
- Ensure security assessments are completed for each information system
- Open POA&Ms for identified weaknesses and assign suspense dates based on SAR findings and recommendations
- Review security assessment documentation and provide written authorization recommendations to the CISO and AO
- Evaluate proposed changes to information systems, operating environments, and mission needs that may affect authorization status
- Serve as a cybersecurity technical advisor to the CISO and AO
- Help develop the system-level continuous monitoring strategy in alignment with applicable DoD enterprise-level or Component-level guidance
- Document risk ratings for noncompliant security controls and overall system risk in the SAR, including key drivers, threats, vulnerabilities, impacts, and mitigation measures
- Develop the continuous monitoring plan for the information system
- Produce RMF deliverables for Step 4 of DoD and IC RMF policies, including tailored Security Assessment Plans, control assessment narratives and artifact reviews, Security Assessment Reports, and ATO recommendations or ATO with Conditions memorandums
- Perform initial remediation actions after the security assessment and support handoff to the ISSM and ISSOs
- Assess selected controls in accordance with the continuous monitoring strategy
- Carry out additional duties in support of corporate cyber security services as assigned
Technologies: - AWS
- Azure
- Cloud
- Excel
- IAM
- Support
- SAP
- Security
More:
We are hiring for a Security Control Assessor to join our Cyber Security Services team and work on site in Arlington, VA. This is a full-time, non-exempt role supporting a critical mission within the intelligence community. The position involves typical office or administrative work with no exposure to adverse environmental conditions, and the work is sedentary with most time spent sitting.
last updated 41 week of 2026
Job Tags
Full time, Work at office