Assessment and Authorization Specialist III (Remote)

Akima, LLC•District of Columbia, DC

1d•Remote

About The Position

The Assessment and Authorization Specialist III (Mid-Level) supports the Department of Energy’s Office of the Chief Information Officer by overseeing and conducting comprehensive assessments of security and privacy controls, identifying risks, and recommending corrective actions to help ensure DOE systems meet cybersecurity and privacy standards. The role also oversees and responds to system- and security-related data calls, research, and analysis requested by DOE. The specialist leads assessments of NIST and FISMA systems, including cloud environments (SaaS, PaaS, and IaaS) and on-premises systems. The position oversees the preparation and review of Assessment and Authorization packages, assessment and findings reports, and related system documentation. It also supports continuous monitoring, remediation, reassessment, and internal and external audit data calls.

Requirements

Bachelor’s degree or four years of equivalent professional experience.
Five to seven years of relevant experience conducting security control assessments, cybersecurity evaluations, or similar technical security work.
Experience overseeing and participating in assessments and working with Security Assessment Teams, Security Control Assessors, Information System Security Officers, Technical Points of Contact, System Owners, and Assessment Coordinators.
Strong understanding of NIST Special Publication 800-53 security and privacy controls, the NIST Cybersecurity Framework, and other information security and privacy laws and regulations.
Demonstrated oversight experience assessing security and privacy controls aligned with federal cybersecurity frameworks such as NIST RMF and NIST SP 800-53.
Ability to analyze technical documentation, identify security gaps, and communicate findings clearly in written reports.
Strong understanding of continuous monitoring processes and system inheritance concepts.
Ability to work independently and collaboratively on complex assignments requiring sound judgment and comprehensive technical knowledge.
Ability to complete a DOE background investigation and obtain federal government clearance for access to federal systems.
Ability to obtain DOE Q clearance.

Responsibilities

Oversee and lead assessments of implemented security and privacy controls and control enhancements to determine whether they are correctly implemented, operating as intended, and achieving desired outcomes.
Lead evaluation and documentation of the severity of assessment deficiencies and guide recommendations for corrective actions to mitigate vulnerabilities.
Lead preparation of security and privacy assessment reports describing results, findings, and recommendations for Team Leaders’ review and decision-making.
Oversee assessments performed according to procedures in approved assessment plans.
Oversee and conduct initial remediation actions for deficient controls and reassess remediated controls to validate their effectiveness.
Assess system-specific and inherited controls as part of the Department’s continuous monitoring strategy.
Contribute to complex assignments, deliverables, and performance metrics.
Oversee assessments of existing and new NIST and FISMA systems, including subsystems, communicate results, explain implications of control weaknesses, and document findings in supporting artifacts.
Lead and oversee assessments of cloud environments, including SaaS, PaaS, and IaaS, as well as on-premises systems and platforms.
Review, analyze, and create A&A packages, including Assessment Readiness Workbooks, Security Assessment Plans, Security Assessment Reports, and Risk Assessments, for completeness, accuracy, and control effectiveness.
Review, analyze, and create findings packages describing findings, weaknesses, and remediation, and provide overviews during findings review meetings.
Oversee reviews of significant system change and deviation requests and provide leadership on potential system or system security impacts.
Review vulnerability scan reports, test reports, POA&Ms, hardware and software lists, network diagrams, data flows, system change requests and proposals, and plans and procedures for completeness, accuracy, control effectiveness, and implementation.
Review documented findings and provide recommendations and oversight for documentation, rationalization, and remediation.
Oversee and lead security- and system-related data calls for internal and external audits, including FISMA audits, and other requested data calls.