Control Assessment Senior

Crest Security Assurance•Washington, DC

3h•$130,000 - $145,000•Onsite

About The Position

Crest Security Assurance (Crest) is seeking a Control Assessment Senior to provide Federal Information Security Modernization Act (FISMA) and Risk Management Framework (RMF) support for federal cloud-based applications and information systems hosted in Microsoft Azure, Amazon Web Services (AWS), and SaaS, PaaS, and IaaS environments. The position supports cloud security assessments, guides cloud systems through the Authorization to Operate (ATO) process, manages Plans of Action and Milestones (POA&Ms), evaluates cloud security configurations and controls, and supports continuous monitoring and ongoing authorization activities. The analyst works alongside security analysts and collaborates with system owners, cloud architects, developers, cloud service providers, technical teams, and vendors. The work includes assessing cloud security controls, evaluating cybersecurity risks, documenting compliance findings, and maintaining security and privacy compliance throughout the system lifecycle. The role requires understanding federal cloud security requirements, FedRAMP, cloud shared responsibility models, and security control inheritance across commercial and government cloud environments.

Requirements

At least five years of experience performing security control assessments, federal security compliance, assessment and authorization, or closely related cybersecurity functions.
Demonstrated experience providing FISMA and RMF support for cloud applications and information systems, including Microsoft Azure, AWS, or comparable federal cloud environments.
Experience assessing SaaS, PaaS, and IaaS models, cloud security architectures, provider-managed versus customer-managed responsibilities, and inherited controls.
Experience supporting federal cloud systems through the ATO process, including authorization documentation, assessments, evidence collection, stakeholder coordination, and approval workflows.
Experience managing POA&Ms and continuous monitoring for federal information systems, including cloud weaknesses, vulnerabilities, configuration deficiencies, and remediation validation.
Experience conducting team-based technical and nontechnical security control assessments, including planning, testing, evidence review, risk evaluation, and findings documentation.
Strong knowledge of NIST RMF, NIST SP 800-37, NIST SP 800-53 Rev. 5 or newer as applicable, NIST SP 800-53A, NIST SP 800-171, FedRAMP, relevant OMB memoranda, and federal cloud security policies.
Understanding of cloud security concepts, including IAM, RBAC, network segmentation, encryption, cloud logging, vulnerability management, configuration baselines, zero trust principles, and cloud data protection.
Familiarity with cloud-native security and compliance tools such as Microsoft Defender for Cloud, Microsoft Entra ID, Azure Policy, AWS Security Hub, AWS Config, AWS CloudTrail, or equivalent platforms.
Experience developing and implementing compliance programs, conducting cybersecurity and privacy risk assessments, and advising system owners and technical stakeholders on cloud security risks and remediation.
Experience maintaining information system inventories, evaluating vendor security documentation, and supporting federal security compliance activities.
Ability to explain complex federal cybersecurity, cloud security, and regulatory requirements and brief technical stakeholders and senior leadership on findings, risks, and recommendations.
Basic understanding of federal procurement processes and contract language related to federal cybersecurity and cloud security mandates.
Experience tracking training and awareness performance and developing metrics for security, privacy, and social engineering training.
U.S. citizenship and ability to work 100% onsite in Washington, DC, five days per week.

Nice To Haves

Experience assessing controls or supporting ATO activities for applications hosted in Azure Government, AWS GovCloud, or FedRAMP-authorized SaaS/PaaS environments.
Experience reviewing FedRAMP authorization packages, including SSPs, SARs, POA&Ms, control inheritance documentation, and customer responsibility matrices.
Experience with federal security compliance and GRC platforms such as CSAM, Xacta, eMASS, or ServiceNow GRC.
Familiarity with hybrid cloud environments, cloud migration security assessments, containerized applications, serverless computing, or modern cloud application architectures.
Relevant certifications such as CISSP, CISA, CAP/CGRC, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate.

Responsibilities

Provide FISMA and NIST RMF support for federal cloud applications and systems through initial authorization preparation, continuous monitoring, and ongoing authorization.
Support cloud-hosted systems through the ATO process by coordinating assessments, preparing and reviewing authorization documentation, evaluating cloud-specific security requirements, tracking approvals, and addressing control implementation and evidence gaps.
Prepare, review, and maintain authorization artifacts, including SSPs, SAPs, SARs, control implementation narratives, cloud architecture and system boundary documentation, and assessment evidence.
Plan and execute technical and nontechnical security control assessments using NIST SP 800-53 Rev. 5 or applicable newer versions and NIST SP 800-53A.
Assess cloud security controls covering IAM, MFA, privileged access, encryption, key management, network security, logging and monitoring, vulnerability management, configuration management, data protection, and incident response.
Evaluate cloud service providers and SaaS/PaaS solutions against FedRAMP, FISMA, NIST, and agency-specific requirements, including reviewing authorization packages, inherited controls, customer-responsible controls, and shared responsibility obligations.
Review cloud-native security configurations, monitoring capabilities, and evidence from applicable tools such as Microsoft Entra ID, Microsoft Defender for Cloud, Azure Policy, Azure Monitor, AWS CloudTrail, AWS Config, and AWS Security Hub.
Manage POA&Ms by documenting weaknesses, evaluating cloud vulnerabilities and misconfigurations, coordinating corrective actions, tracking remediation milestones, and validating closure evidence.
Support continuous monitoring through recurring assessments, vulnerability and configuration reviews, security event analysis, change impact assessments, and compliance reporting.
Assess security implications of cloud migrations, SaaS/PaaS integrations, infrastructure changes, application deployments, and authorization boundary changes; identify potential impacts to ATOs and control implementations.
Improve cloud security assessment and authorization processes, including assessment procedures, control testing methods, evidence collection, reporting metrics, and compliance documentation.
Assess cybersecurity and data privacy risks involving cloud infrastructure, applications, third-party SaaS, and externally managed platforms; prepare findings, executive summaries, and risk recommendations.
Support cloud vendor risk management, including evaluation of provider documentation, FedRAMP authorization status, third-party assessments, service-level agreements, and compliance responsibilities.
Collaborate with architects, administrators, developers, application owners, and vendors to identify gaps, validate remediation, and integrate security requirements into cloud operations.
Maintain information system inventories, including cloud applications, SaaS subscriptions, service dependencies, authorization boundaries, and security and privacy assets.
Support security reporting and dashboard development covering cloud compliance posture, assessment results, POA&Ms, vulnerability trends, and ongoing authorization status.
Develop metrics and reports on the effectiveness of security, privacy, and social engineering training and awareness activities.