Security Control Assessor

M9 Solutions is seeking a Security Control Assessor to work onsite in support of a government contract for a client located in Washington, DC. An active Secret clearance is required.

Responsibilities

• Evaluate, test, and validate the effectiveness of security controls within our organization's information systems and networks, with a strong emphasis on applying the Risk Management Framework (RMF).
• Provide the client with tailored documentation to support their security authorization.
• Independent assessor for Risk Management Framework Steps 0 to 7.
• Plan and execute security control assessments for various information systems within the organization.
• Develop and maintain assessment procedures and methodologies aligned with NIST guidelines and other relevant frameworks.
• Analyze and evaluate the effectiveness of implemented security controls.
• Identify vulnerabilities, weaknesses, and potential risks in information systems and infrastructure.
• Prepare detailed Security Assessment Reports (SARs) documenting findings and recommendations.
• Collaborate with system owners, ISSOs, and other stakeholders throughout the assessment process.
• Verify the implementation of remediation actions and conduct follow-up assessments as needed.
• Provide expert advice on the development and maintenance of System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms).
• Stay current with evolving cybersecurity threats, technologies, and best practices.
• Validate security control implementation and provide test results.
• Hands-on experience in assessing RMF Step 4 and performing continuous monitoring.
• Examine security control weaknesses and determine if they are producing the desired intent.
• Deep understanding of Vulnerability Management practices.

Required Skills and Qualifications

• Active Secret clearance.
• Bachelor's degree or equivalent years of relevant experience.
• CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
• Intimate understanding of NIST RMF implementation guidance.
• Hands-on experience with using eMASS or similar Information Assurance tools.
• Experience analyzing vulnerability scans and STIG implementations.
• Knowledge/Familiarity with NIST SP 800-18, 60, 70, 53, 53A, 137, IACS, CMRS, COAMS, JIMS, Swimlane, Governance, Risk, and Compliance, POA&M (i.e., Management, Assessment, etc.), ERS, FISMA, Knowledge Service, ACAS, Tanium, Power BI, Project/Program Management, TASKORD (i.e., FRAGO, CTO, etc.), and Data Calls (i.e., OIG Audit, etc.)

Preferred Skills and Qualifications

• Well-developed understanding of Systems Development Lifecycle (SDLC) and Systems Engineering Lifecycle (SELC) process as it relates to Security Assessment and Authorization (SA&A).
• Cybersecurity Information Assurance-focused experience with specific current hands-on experience researching, writing, and submitting complete documentation packages for new system authorizations.