Cybersecurity Assessor

CompQsoft, Inc.•New York, NY

1d•$125,000 - $130,000

About The Position

The Cybersecurity Assessor evaluates enterprise systems, networks, applications, and third-party vendors to identify vulnerabilities, assess risks, and support compliance with security policies and regulatory standards. The role provides actionable recommendations and collaborates with technical and business teams to strengthen security controls and reduce organizational risk. The assessor conducts security and compliance assessments, interprets federal mandates including NIST SP 800-53 and NIST SP 800-37, and evaluates technical and administrative controls. Responsibilities include conducting Security Impact Analyses, performing daily Risk Management Framework (RMF) lifecycle control assessments, collecting evidence, conducting walkthroughs and testing, and maintaining Plan of Action and Milestones (POA&M) documentation. The role also tracks findings and remediation, coordinates with stakeholders to resolve risks within accepted thresholds, and maintains assessment records and risk metrics. It uses GRC and third-party risk platforms to manage assessment workflows and tools such as Power BI and Excel to report enterprise security posture. The assessor serves as a bridge between Business Analysts and Cybersecurity Engineers, translating compliance requirements into actionable remediation tasks.

Requirements

At least 5 years of experience.
Expertise in GRC methodologies, security control auditing, and third-party risk assessments.
Ability to interpret federal compliance mandates, including NIST SP 800-53 and NIST SP 800-37.
Ability to evaluate technical and administrative controls.
Competency in conducting Security Impact Analyses and managing POA&M documentation.
Proficiency with GRC platforms such as Archer or ServiceNow.
Proficiency with third-party risk tools such as OneTrust or Prevalent.
Advanced proficiency in Microsoft Excel and experience with Microsoft Power BI, Microsoft Visio, JIRA, and the Microsoft Office Suite.
One or more of the listed certifications: CISA, CRISC, CGEIT, CISSP, CompTIA Security+, CCSK, or CAP/ISC2 CGRC.

Responsibilities

Conduct security and compliance assessments across internal systems and third-party vendors.
Evaluate external service providers' security practices and help manage vendor-related risks throughout the assessment lifecycle.
Interpret federal compliance mandates, including NIST SP 800-53 and NIST SP 800-37, and evaluate technical and administrative controls.
Conduct Security Impact Analyses and daily RMF lifecycle control assessments, including evidence collection, walkthroughs, and control testing.
Document assessment findings, track remediation issues, and help teams prioritize corrective actions.
Coordinate with business and technical stakeholders to clarify compliance requirements and resolve identified risks within accepted thresholds.
Maintain assessment documentation, risk metrics, and reporting dashboards using risk management tools.
Translate compliance requirements into actionable remediation tasks while coordinating between Business Analysts and Cybersecurity Engineers.
Use GRC platforms and third-party risk tools to centralize documentation and streamline assessment workflows.
Create and maintain Power BI and Excel dashboards that communicate enterprise security posture to stakeholders.
Track POA&Ms to help ensure organizational risk remains within tolerance.