Security Assessment & Authorization; SA&A) Lead

Security Assessment And Authorization Lead

Salary: $130,000 - $145,000/year

Work location:

Hybrid, 2-3 days per week on-site in Bethesda, MD.

Lead Security Assessment and Authorization (SA&A) activities for NIH CIT enterprise information systems, including on-premises, cloud-based, network, hosting, endpoint, and shared-service environments.

Plan, develop, coordinate, review, and maintain Authorization to Operate (ATO) packages in accordance with the NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53, FISMA, and applicable HHS, NIH, and federal security requirements.

Lead development and maintenance of system authorization artifacts, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), risk assessments, contingency plans, incident response plans, and associated supporting documentation.

Write, review, assess, and validate security-control implementation statements against applicable NIST SP 800-53 controls and control enhancements.

Conduct security-control assessments, including evidence review, technical validation, stakeholder interviews, and assessment testing; document findings, assess risks, and recommend corrective actions.

Create, maintain, track, and update Plans of Action and Milestones (POA&Ms), ensuring findings have clear owners, remediation milestones, risk ratings, status updates, and closure evidence.

Prepare Risk Assessment Memoranda and other risk-based decision packages that clearly describe security risks, proposed mitigations, residual risk, and recommended courses of action for management review.

Develop and maintain system and program-level risk registers; identify and communicate high-risk conditions, trends, overdue remediation actions, dependencies, and emerging compliance concerns to program and Government leadership.

Coordinate and facilitate incident response (IR) and contingency planning (CP) tests, tabletop exercises, and after-action activities; document results, corrective actions, lessons learned, and required updates to security documentation.

Review ATO packages for completeness, accuracy, consistency, and readiness before submission to the CISO, CIO, Authorizing Official, or designated approval authority.

Conduct assessment entrance and exit meetings with system owners, system administrators, ISSOs, engineers, and other stakeholders; debrief teams on assessment findings, remediation expectations, and next steps.

Advise system owners and technical teams on RMF implementation, security-control compliance, risk acceptance, remediation planning, and authorization strategy.

Prepare clear, timely assessment reports, compliance dashboards, executive briefings, status reports, and decision memoranda for technical and leadership audiences.

Lead and mentor SA&A analysts and assessors; assign and review work, maintain quality standards, and coordinate simultaneous authorization and continuous-monitoring activities across multiple systems.

Minimum of three (3) to five (5) years of progressively responsible experience in security assessment and authorization, RMF, information-system security, cybersecurity compliance, or a related discipline.

Candidates must demonstrate experience in:

• Developing, updating, and submitting ATO packages for enterprise systems, including cloud-hosted or hybrid environments.
• Applying the NIST RMF lifecycle under NIST SP 800-37.
• Assessing and documenting implementation of NIST SP 800-53 security controls and control enhancements.
• Creating and maintaining SSPs, SARs, SAPs, POA&Ms, risk assessments, risk registers, and other authorization artifacts.
• Planning and conducting security-control assessments, evidence reviews, stakeholder interviews, technical validations, and remediation verification.
• Facilitating IR and CP tests or tabletop exercises and documenting outcomes and corrective actions.
• Preparing risk-based decision packages, including risk assessment memoranda and risk acceptance/mitigation recommendations.
• Reviewing authorization packages before senior leadership submission and briefing assessment findings to system owners and management.
• Supporting continuous-monitoring, vulnerability-management, configuration-management, and compliance-reporting processes.
• Bachelor's degree from an accredited college or university in cybersecurity, information assurance, information systems, computer science, computer engineering, network engineering, systems engineering, or a closely related technical discipline.
• Certified Information Systems Security Professional (CISSP), current and active
• Certified Authorization Professional (CAP), current and active

Clearance Requirement:
Ability to obtain and maintain a Public Trust.

Desired

Qualifications:

• Master's degree in cybersecurity, information assurance, information systems, computer science, engineering, public administration, business administration, or a related discipline.
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified…