Security Assessor/Analyst Lead

Guidehouse•Tysons Corner, VA

12d

About The Position

The Security Assessor/Analyst Lead leads and supports security and privacy control assessments in public-sector and regulated environments. The role provides technical leadership, quality oversight, and day-to-day supervision of assessment teams, evaluates the effectiveness of security and privacy controls, validates technical and procedural evidence, advises clients on risks and remediation considerations, and oversees high-quality assessment documentation. The position also helps mature and scale security assessment capabilities through standardized methodologies, automation, emerging technologies, and team development. The successful candidate independently leads assessment activities, engages senior client stakeholders, and translates complex technical and compliance issues into clear, actionable findings. Guidehouse offers a comprehensive total rewards package, including competitive compensation and flexible benefits. The position may be eligible for a discretionary variable incentive bonus. US citizenship is contractually required.

Requirements

At least 5 years of professional experience in cybersecurity, information security, technology risk, audit, security control assessment, authorization, or a related discipline.
At least 3 years of supervisory or team leadership experience overseeing security assessor teams or security assessment-related personnel.
Bachelor's degree from an accredited university.
US citizenship; contractually required.
Demonstrated experience leading or performing security control assessments, audits, risk assessments, or authorization activities.
Hands-on experience developing or reviewing formal security assessment documentation, such as SSPs, SARs, POA&Ms, ISRAs, or equivalent artifacts.
Strong working knowledge of NIST SP 800-53 security and privacy controls and risk-based assessment concepts.
Experience evaluating technical and procedural evidence to assess control effectiveness and identify security or compliance gaps.
Experience leading interviews, assessment discussions, and working sessions with technical personnel, system owners, security teams, and other client stakeholders.
Ability to translate complex technical and security issues into clear, concise, and defensible findings and recommendations.
Experience reviewing other assessors’ work and maintaining quality and consistency across assessment deliverables.
Strong written and verbal communication skills, including effective communication with technical and senior client stakeholders.
Ability to manage multiple assessment activities, priorities, and deliverables in a client-service environment.

Nice To Haves

Experience supporting federal, state, local, healthcare, or other highly regulated environments.
Experience with CMS, healthcare, or public-sector security and privacy compliance frameworks.
Deep familiarity with Assessment & Authorization (A&A), Risk Management Framework (RMF), Security Control Assessment (SCA), or similar risk and compliance processes.
Relevant certifications such as CISA, CISSP, CISM, CRISC, Security+, CAP/CGRC, or similar.
Experience with security engineering, cloud security, identity and access management (IAM), logging and monitoring, vulnerability management, or system implementation.
Familiarity with modern technology architectures, including cloud platforms, IAM solutions, APIs, and security monitoring platforms, and with how security controls are implemented and assessed in these environments.
Experience with automation, scripting, data analytics, or Governance, Risk, and Compliance (GRC) platforms supporting assessment or compliance activities.
Experience applying AI, automation, or data-driven techniques to improve audit readiness, evidence analysis, compliance monitoring, assessment execution, or reporting.
Experience supporting business development, growth, capture, proposal development, or client account expansion in cybersecurity, technology risk, or related consulting services.
Experience identifying client needs and developing cybersecurity services, methodologies, accelerators, intellectual property, or other firm capabilities.
Experience contributing to proposals, solutioning, oral presentations, demonstrations, marketing materials, white papers, or other go-to-market activities.
Experience building relationships with clients, industry partners, technology vendors, or other ecosystem organizations to support growth and capability development.
Interest in growing and differentiating a cybersecurity assessment practice through thought leadership, innovation, market awareness, and repeatable service offerings.

Responsibilities

Lead security and privacy control assessments in accordance with assessment plans, applicable standards, and client requirements.
Supervise and direct security assessor teams, including assigning activities, reviewing work products, providing quality assurance, coaching, and supporting professional development.
Lead assessment planning, execution, documentation, and reporting across multiple systems, workstreams, or client stakeholders.
Review security documentation and technical evidence to assess the design, implementation, and operating effectiveness of security and privacy controls.
Lead and participate in control validation, including evidence analysis, architecture and system documentation reviews, stakeholder interviews and working sessions, and evaluation of technical configurations and implementation evidence.
Develop and quality-review assessment artifacts, including SSPs, SARs, ISRAs, POA&Ms, and other risk, compliance, and authorization documentation.
Communicate control deficiencies, security risks, root causes, and potential remediation considerations to technical and executive audiences.
Maintain assessment independence, objectivity, and professional judgment.
Advise client stakeholders on assessment results, risk implications, and opportunities to strengthen security and privacy controls.
Establish and promote consistent assessment methodologies, templates, quality standards, and leading practices across teams.
Identify ways to improve assessment efficiency and quality through standardization, tooling, automation, and enhanced evidence collection and validation.
Support the use of data analytics, AI-assisted techniques, and automation to improve assessment analysis, evidence traceability, reporting, and continuous monitoring.
Mentor junior and mid-level security professionals and contribute to cybersecurity capability development and knowledge sharing.