Cybersecurity Assessor

Technical Assessor

The Technical Assessor conducts in-depth technical and program-level cybersecurity assessments of client environments, identifying risk, measuring control maturity, and producing clear, actionable guidance that advances each client's security posture. This is an experienced assessor role: the individual independently leads assessments end to end, evaluates complex environments against multiple frameworks, and is a trusted voice in front of both technical teams and executives.

The assessor also helps mature Apollo's assessment methodology and mentors more junior assessors.

Key responsibilities include:

• Independently plan and lead hands-on cybersecurity assessments across enterprise, cloud, and public-sector environments — including election infrastructure at the county, city, and state level.
• Evaluate the design and operating effectiveness of technical controls spanning identity and access management, endpoint protection, patch and vulnerability management, secure configuration, network segmentation, data protection, logging/monitoring, and incident response.
• Review and interpret technical configurations and artifacts — firewall rulesets, GPOs, hardening baselines, cloud security configurations, IAM policies, and logging setups — to validate control implementation.
• Conduct stakeholder interviews and documentation reviews to understand policy, process, and control maturity.
• Assess client environments against established frameworks and standards including NIST CSF 2.0, CIS Controls, ISO 27001, CMMC, CJIS, HIPAA, and PCI DSS.
• Produce detailed assessment reports with prioritized risk findings, maturity ratings, and pragmatic, business-aware recommendations.
• Map findings to client risk and business context, translating technical gaps into clear remediation roadmaps.
• Present findings and recommendations to client stakeholders ranging from technical practitioners to executive leadership.
• Drive continuous improvement of Apollo's assessment methodologies, workbooks, tooling, and report templates.
• Mentor junior assessors and perform peer review of assessment deliverables.
• Collaborate with consultants, engineers, advisors, and project managers to deliver high-quality engagements.
• Stay current with emerging threats, technologies, and regulatory developments.

Qualifications include:

• Required:
• Experience in cybersecurity, with demonstrable experience leading or performing security assessments (confirm threshold).
• Direct, hands-on experience assessing environments against one or more recognized frameworks (NIST CSF, CIS Controls, ISO 27001, CMMC, CJIS, HIPAA, or PCI DSS).
• Strong working knowledge of security controls across operating systems, network infrastructure, cloud services, and identity systems.
• Ability to independently review and assess technical configurations and documentation (firewall rules, GPOs, hardening baselines, logging setups, cloud configs).
• Excellent written communication and the ability to produce client-ready reports, plus the ability to explain technical findings in plain language to non-technical audiences.
• Experience working with clients in a consulting capacity and managing multiple concurrent engagements.
• Preferred:
• One or more relevant certifications — e.g., Security+, CySA+, CISA, GIAC (e.g., GSEC), or assessor-specific credentials such as CMMC CCP/CCA.
• Hands-on familiarity with Microsoft 365 and Azure (and exposure to AWS or GCP).
• Experience with security tooling — vulnerability scanners, SIEM/EDR platforms, and configuration analyzers.
• Experience supporting public sector clients, election infrastructure, or regulated industries.

Expectations include:

• At 30 days:
• Complete onboarding to Apollo's assessment methodology, workbooks, report templates, and quality standards
• Review at least two completed assessment reports to calibrate Apollo's voice, depth of technical analysis, and the standard for translating findings into executive-ready language
• Shadow a senior assessor through an active engagement
• Within 90 days:
• Lead at least one assessment end-to-end independently
• Demonstrate working command of the frameworks relevant to your assigned engagements (NIST CSF 2.0, CIS Controls, CMMC, CJIS,…