Cyber Security Control Assessor

CACI International•Washington, DC

2d•$86,600 - $181,800•Onsite

About The Position

CACI is searching for a Cyber Security Control Assessor to support the FEMA Office of the Chief Information Security Officer (OCISO) in Washington, D.C. As a Cyber Security Control Assessor, you will play a crucial role in ensuring the security and compliance of FEMA's information systems through comprehensive independent assessment of security controls. You will work in a dynamic environment, collaborating with system owners, ISSOs, stakeholders, and cybersecurity professionals to evaluate the effectiveness of security control implementation. Your efforts will directly contribute to safeguarding FEMA's mission-critical systems and data. The Cyber Security Control Assessor will serve as an independent assessor for control design, implementation, and effectiveness across assigned systems and authorization boundaries. This position requires evaluating the effectiveness of IT security controls including management, operational, and technical controls and determining if controls meet compliance requirements under NIST SP 800-53 and DHS RMF. The Cyber Security Control Assessor will perform assessment procedures including interviews, examinations, and testing and verify control implementation and effectiveness. This role is critical for analyzing System Security Plans (SSPs), policies, procedures, and evidence artifacts to identify security gaps and evaluate residual risk.

Requirements

U.S. Citizenship required
BS/BA + 6 years of applicable experience in in RMF, control assessment, audit, cybersecurity compliance, or security engineering
Demonstrated knowledge in NIST SP 800-53, NIST SP 800-37 (RMF), and DHS 4300 Series
Experience with security control assessment methodologies and tools
Knowledge of scanning tool results (Tenable, Qualys, dbProtect), CSAM, STIG Viewer, and Risk Management Framework tools
Experience conducting security assessments and generating Security Assessment artifacts (Security Assessment Plans (SAPs), Risk Traceability Matrices (RTMs), and Security Assessment Reports (SARs))
Strong analytical skills for identifying security gaps and evaluating residual risk
Knowledge of assessment methodologies and risk analysis
Experience developing POA&Ms
Strong analytical skills for vulnerability prioritization and trend analysis

Nice To Haves

FEMA EOD suitability or Current DHS or FEMA EOD preferred
Active Secret security clearance
Previous DHS or DoD experience
Experience with CSAM, RegScale, eMASS, or similar GRC tools
Knowledge of FedRAMP assessment processes, DISA STIGs and cybersecurity compliance frameworks
Experience with continuous monitoring and ongoing authorization activities
Strong technical writing skills for assessment documentation
Experience supporting audit activities and authorization decisions
Have or working towards related IT security certification(s)
CompTIA Security+
ISACA CISA (Certified Information Systems Auditor)
Certified Information System Security Professional (CISSP)
CompTIA SecurityX (formerly CASP+)

Responsibilities

Evaluate the effectiveness of IT security controls and determine if controls meet compliance requirements under NIST SP 800-53 and DHS RMF.
Perform assessment procedures including interviews, examinations, and testing to verify control implementation and effectiveness.
Analyze System Security Plans (SSPs), policies, procedures, and evidence artifacts while reviewing security documentation for completeness and accuracy.
Identify security gaps and evaluate residual risk.
Generate findings for security assessment reports.
Perform security reviews and identify security gaps in security architecture while providing recommendations for inclusion in risk mitigation strategy.
Evaluate technical, operational, and management controls and conduct independent assessments across assigned systems and authorization boundaries.
Review and maintain in the system of record security architecture documentation.
Provide critical written and verbal analyses of previously generated security architecture documentation and vulnerability and risk assessments.
Support authorization to operate IT systems at acceptable levels of risk.
Monitor and test IT systems for vulnerabilities and indicia of compromise.
Support incident response and remediation activities.
Provide information assurance for digital information, ensuring its confidentiality, integrity, and availability.
Support the development of appropriate policy and relevant user security awareness and training.
Ensure compliance with applicable government and other external standards.
Generate the appropriate assessment artifacts and document assessment findings.
Support continuous monitoring activities and ongoing authorization efforts.