Security Assessor
About The Position
The Security Assessor will help ensure the security and compliance of information systems for the HHS ACL EITS program. The role assesses security controls, conducts audits and risk assessments, and develops secure architectures aligned with federal regulations and guidance, including FISMA, NIST 800-53, FedRAMP, and the NIST Risk Management Framework. The assessor collaborates with the Information System Security Officer, Cloud Infrastructure Architect, application developers, the Authorizing Official, and other stakeholders to maintain a secure and resilient environment. The position also supports authorization activities, vulnerability assessment and penetration testing, incident response and forensic investigations, security documentation, and security awareness training. The position is remote, and teleworking is permitted.
Requirements
- Bachelor's degree in Cybersecurity, Information Technology, or additional experience in lieu of a degree.
- At least 5 years of experience in security architecture, security assessment, or a related cybersecurity role in a federal or government environment.
- Ability to pass a Public Trust Background Investigation.
- Extensive experience with NIST RMF, FISMA, FedRAMP, and other federal security frameworks.
- Familiarity with cloud security architectures, particularly Microsoft Azure and/or AWS.
- Strong understanding of vulnerability management, penetration testing, and forensic investigation tools.
- Experience with SIEM tools, security monitoring, and incident response frameworks.
Nice To Haves
- Certified Information Systems Auditor (CISA) or Certified Ethical Hacker (CEH) certification.
- Certified Information Security Manager (CISM) or Certified Cloud Security Professional (CCSP) certification.
- Certified Information Systems Security Professional (CISSP), or equivalent experience and knowledge commensurate with certification requirements.
Responsibilities
- Conduct comprehensive security control assessments of HHS ACL EITS systems for compliance with FISMA, NIST 800-53, FedRAMP, and other federal regulations.
- Prepare and present security assessment reports to senior management and government stakeholders.
- Develop and maintain secure architecture designs that comply with federal security standards and protect confidentiality, integrity, and availability.
- Collaborate with the Cloud Infrastructure Architect and application developers to integrate security controls into system design and implementation.
- Apply security-by-design principles and ensure software, systems, and infrastructure meet security requirements.
- Conduct risk assessments and prioritize risks associated with information systems.
- Develop and implement risk mitigation strategies aligned with government standards.
- Maintain accurate, current security documentation, including System Security Plans and Risk Management Framework artifacts.
- Perform vulnerability assessments and penetration testing to identify and remediate security weaknesses.
- Assist with preparing and executing Authorization and Accreditation packages in compliance with NIST RMF.
- Work with the Authorizing Official to support timely system authorization and maintain accurate authorization status.
- Assist with incident response, including investigating and reporting security breaches, unauthorized access, and other incidents.
- Lead forensic investigations, determine incident root causes, and recommend remediation.
- Prepare post-incident reports documenting findings and actions to prevent recurrence.
- Develop and deliver security awareness training for staff and stakeholders.
- Promote a security-first mindset across the program.
- Perform other duties as assigned.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
