Cyber Information Systems Analyst - SME - Assessment Function (SCA-Separate)

Qbe•Haymarket, VA

2d•Remote

About The Position

QBE, LLC is seeking a Cyber Information Systems Analyst - SME - Assessment Function (SCA-Separate) to provide independent security control assessment expertise supporting NIH/OD-OIT. This position is primarily remote but will require some TDY.

Requirements

Associate degree in cybersecurity, information technology, computer science, information systems, business, communications, or a related field, or an additional two or more years of relevant experience in place of the degree requirement.
At least 10 years of relevant experience aligned to the responsibilities of this position.
Extensive experience conducting independent security control assessments.
Expert knowledge of federal RMF and security control assessment practices.
Experience developing Security Assessment Plans and Security Assessment Reports.
Strong technical testing, risk analysis, and documentation skills.
CompTIA Security+ certification.
GIAC Information Security Professional (GISP) certification.
Ability to obtain and maintain the required federal background investigation, Public Trust determination, or security clearance associated with the position.

Nice To Haves

Experience serving as a Security Control Assessor or supporting an independent assessment organization.
Experience assessing Low- and Moderate-impact federal systems.
Experience with HHS, NIH, or another federal civilian agency.

Responsibilities

Plan and conduct independent security control assessments.
Develop Security Assessment Plans and test procedures.
Review security documentation and supporting control evidence.
Interview system personnel and evaluate control implementation.
Perform technical and procedural testing of applicable controls.
Document assessment findings and supporting evidence.
Develop Security Assessment Reports and risk statements.
Maintain organizational independence between assessment and system implementation functions.
Evaluate remediation evidence for identified deficiencies.
Coordinate assessment schedules and activities with system stakeholders.