Security Assessor

Guidehouse•Tysons, VA

About The Position

The Security Assessor supports security and privacy control assessments for public-sector systems by evaluating control effectiveness, validating evidence, and contributing to formal assessment documentation under the direction of a Senior Security Assessor. The role primarily focuses on assessment execution and documentation, while offering exposure to technical aspects of system architecture and control implementation. Candidates should be curious and interested in expanding their skills in security engineering, automation, and AI-enabled compliance and assessment approaches. This role does not involve system engineering or operational security responsibilities.

Requirements

At least three years of overall work experience, ideally supporting security control assessments, audits, or authorization activities.
Bachelor’s degree from an accredited university.
U.S. citizenship is contractually required.
Hands-on experience contributing to formal security assessment documentation, such as SSPs, SARs, POA&Ms, or equivalents.
Working knowledge of NIST SP 800-53 security and privacy controls.
Understanding of risk-based assessment concepts.
Ability to analyze assessment evidence and clearly document findings.

Nice To Haves

Experience supporting government or other regulated environments.
Exposure to CMS, healthcare, or public-sector security compliance frameworks.
Familiarity with A&A, RMF, or Security Control Assessment processes.
Relevant certifications such as CISA, CISSP, CISM, Security+, or similar.
Prior background in or exposure to security engineering, cloud security, or system implementation.
Familiarity with modern architectures, including cloud platforms, IAM, logging and monitoring, and APIs, and how controls are implemented in those environments.
Exposure to automation tools, scripting, or GRC platforms supporting assessment or compliance activities.
Interest in applying AI or automation to improve audit readiness, evidence analysis, or continuous monitoring processes.

Responsibilities

Perform security and privacy control assessments in accordance with established assessment plans.
Review security documentation and technical evidence.
Validate control implementation through evidence inspection, review of architecture and system documentation, and interviews with system owners and technical staff.
Contribute to assessment artifacts, including SSP updates, SARs, ISRAs, and POA&Ms.
Document assessment results and clearly articulate control gaps and risks.
Maintain assessment independence and objectivity.
Identify opportunities to improve assessment efficiency through standardization, tooling, or automation of evidence collection and validation.
Support data-driven or AI-assisted techniques to enhance analysis, traceability, and reporting over time.

Benefits

Medical, prescription, dental, and vision insurance.
Personal and family sick time and company-paid holidays.
Position may be eligible for a discretionary variable incentive bonus.
Parental leave and adoption assistance.
401(k) retirement plan.
Basic life and supplemental life insurance.
Health Savings Account and dental/vision and dependent care Flexible Spending Accounts.
Short-term and long-term disability.
Student loan paydown.
Tuition reimbursement, personal development, and learning opportunities.
Skills development and certifications.
Employee referral program.
Corporate-sponsored events and community outreach.
Emergency back-up childcare program.
Mobility stipend.
Flexible benefits package.