Security Assessor

Chenega Corporation • UNAVAILABLE, Virginia

1d • Remote

About The Position

The Security Assessor will help ensure the security and compliance of information systems supporting the HHS ACL EITS program. The role assesses security controls, conducts audits, and develops secure architectures aligned with federal regulations and guidelines, including FISMA, NIST 800-53, and FedRAMP. The Security Assessor collaborates with the Information System Security Officer (ISSO), Cloud Infrastructure Architect, and program teams to support a secure and resilient environment.

The position also contributes to risk management, vulnerability assessment, penetration testing, incident response, authorization activities, and security awareness. It maintains security documentation and works with government stakeholders to support system authorization and ongoing security operations.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, or additional experience in lieu of a degree.
• At least 5 years of experience in security architecture, security assessment, or a related cybersecurity role in a federal or government environment.
• Ability to pass a Public Trust Background Investigation.
• Extensive experience with NIST RMF, FISMA, FedRAMP, and other federal security frameworks.
• Familiarity with cloud security architectures, particularly Microsoft Azure and/or AWS.
• Strong understanding of vulnerability management, penetration testing, and forensic investigation tools.
• Experience with SIEM tools, security monitoring, and incident response frameworks.

Nice To Haves

• Certified Information Systems Auditor (CISA) or Certified Ethical Hacker (CEH) certification.
• Certified Information Security Manager (CISM) or Certified Cloud Security Professional (CCSP) certification.
• Certified Information Systems Security Professional (CISSP), or equivalent experience and knowledge commensurate with certification requirements.

Responsibilities

• Conduct security control assessments of HHS ACL EITS systems for compliance with FISMA, NIST 800-53, FedRAMP, and other federal regulations.
• Prepare and present security assessment reports to senior management and government stakeholders.
• Develop and maintain secure architecture designs that comply with federal security standards and protect confidentiality, integrity, and availability.
• Collaborate with the Cloud Infrastructure Architect and Application Developers to integrate security controls into system design and implementation.
• Apply security-by-design principles and ensure software, systems, and infrastructure meet security requirements.
• Conduct risk assessments and develop and implement risk mitigation strategies.
• Maintain accurate and current System Security Plans (SSPs), Risk Management Framework (RMF) artifacts, and other security documentation.
• Perform vulnerability assessments and penetration testing to identify and remediate security weaknesses.
• Assist with preparing and executing Authorization and Accreditation (A&A) packages in accordance with NIST RMF.
• Work with the Authorizing Official (AO) to support timely system authorization and maintain current authorization status.
• Assist with incident response, including investigating and reporting security breaches, unauthorized access, and other security incidents.
• Lead forensic investigations, identify incident root causes, and recommend remediation.
• Prepare post-incident reports documenting findings and actions to prevent future incidents.
• Develop and deliver security awareness training for staff and stakeholders.
• Promote a security-first mindset across the program.
• Perform other duties as assigned.

Benefits

• Professional development opportunities, including on-the-job learning and formal development programs.
• Well-being programs.
• Flexibility to make daily choices that support employee well-being.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level