Security Control Assessor

M9 Solutions is seeking a Security Control Assessor to work onsite in support of a government contract for a client located in Washington, DC. An active Secret clearance is required.

Responsibilities

• Provide the client with tailored documentation to support their security authorization.
• Independent assessor for Risk Management Framework Steps 0 to 7.
• Plan and execute security control assessments for various information systems within the client organization.
• Develop and maintain assessment procedures and methodologies aligned with NIST guidelines and other relevant frameworks.
• Analyze and evaluate the effectiveness of implemented security controls.
• Identify vulnerabilities, weaknesses, and potential risks in information systems and infrastructure.
• Prepare detailed Security Assessment Reports (SARs) documenting findings and recommendations.
• Collaborate with system owners, ISSOs, and other stakeholders throughout the assessment process.
• Verify the implementation of remediation actions and conduct follow-up assessments as needed.
• Provide expert advice on the development and maintenance of System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms).
• Stay current with evolving cybersecurity threats, technologies, and best practices.
• Validate security control implementation and provide test results.
• Examine security control weaknesses and determine if they are producing the desired intent.
• Assess and validate security controls in cloud environments (AWS and/or Azure) and review cloud architectures to ensure alignment with RMF and federal cybersecurity requirements

Required Skills and Qualifications

• Active Secret security clearance.
• Bachelor’s degree or equivalent years of relevant experience.
• 5+ years of relevant experience.
• Intimate understanding of NIST RMF implementation guidance.
• Hands-on experience with using eMASS or similar Information Assurance tools.
• Hands-on experience in assessing RMF Step 4 and performing continuous monitoring.
• Experience in analyzing vulnerability scans and STIG implementations.
• Experience working with AWS and/or Azure cloud environments.
• Deep understanding of Vulnerability Management practices.

Preferred Skills and Qualifications

• Well-developed understanding of Systems Development Lifecycle (SDLC) and ideally the Systems Engineering Lifecycle (SELC) process as it relates to Security Assessment and Authorization (SA&A).
• Relevant Cyber Security Information Assurance focused experience with specific current hands-on experience researching, writing, and submitting complete documentation packages for new system authorizations.
• Strong executive presence and customer engagement skills, with the ability to clearly communicate assessment findings and recommendations to government stakeholders.