Lead Security Control Assessor

Rockville, MD (Primarily Onsite)

Support federal Assessment & Authorization (A&A), Authorization to Operate (ATO), and continuous monitoring activities by independently assessing security controls, reviewing authorization documentation, identifying risks, and validating remediation.

• Conduct security control assessments in accordance with the NIST Risk Management Framework.
• Support A&A/ATO activities, including initial authorizations, renewals, significant-change assessments, and continuous monitoring.
• Develop and execute Security Assessment Plans and prepare Security Assessment Reports.
• Review SSPs, SAPs, SARs, POA&Ms, risk assessments, contingency plans, vulnerability scans, and supporting evidence.
• Document findings, assess risk, validate corrective actions, and support closure of security deficiencies.
• Coordinate with system owners, engineers, ISSOs, cybersecurity teams, and government stakeholders.

• Bachelor’s degree in cybersecurity, IT, computer science, engineering, or related field.
• 5+ years of cybersecurity/information security experience.
• 3+ years of direct federal A&A, ATO, or NIST RMF experience.
• Hands‑on Security Control Assessor experience.
• Strong knowledge of NIST SP 800-37, 800-53, 800-53A, and 800-30.
• Experience reviewing federal security authorization packages and technical security evidence.
• Strong written and verbal communication skills.

• Active CISSP or CISM.

• NIH/HHS or other federal civilian agency experience.
• Experience with GRC platforms, FedRAMP/cloud environments, and tools such as Tenable, Nessus, Qualys, or Splunk