Security Assessor
About The Position
The Security Assessor will help ensure the security and compliance of information systems supporting the HHS ACL EITS program. The role assesses security controls, conducts audits, and develops secure architectures aligned with federal regulations and guidance, including FISMA, NIST 800-53, and FedRAMP. The Security Assessor collaborates with the Information System Security Officer (ISSO), Cloud Infrastructure Architect, application developers, and other program teams to maintain a secure and resilient environment. The position also supports risk management, vulnerability assessment, penetration testing, incident response, authorization activities, and security awareness. It helps ensure systems and supporting documentation accurately reflect the program’s security posture and meet government requirements.
Requirements
- Bachelor's degree in Cybersecurity or Information Technology, or additional experience in lieu of a degree.
- At least 5 years of experience in security architecture, security assessment, or a related cybersecurity role in a federal or government environment.
- Ability to pass a Public Trust background investigation.
- Extensive experience with NIST RMF, FISMA, FedRAMP, and other federal security frameworks.
- Familiarity with cloud security architectures, particularly Microsoft Azure and/or AWS.
- Strong understanding of vulnerability management, penetration testing, and forensic investigation tools.
- Experience with SIEM tools, security monitoring, and incident response frameworks.
Nice To Haves
- Certified Information Systems Auditor (CISA) or Certified Ethical Hacker (CEH) certification preferred.
- Certified Information Security Manager (CISM) or Certified Cloud Security Professional (CCSP) certification is a plus.
- Certified Information Systems Security Professional (CISSP), or equivalent experience and knowledge commensurate with certification requirements.
Responsibilities
- Conduct security control assessments of HHS ACL EITS systems for compliance with FISMA, NIST 800-53, FedRAMP, and other federal regulations.
- Prepare and present security assessment reports to senior management and government stakeholders.
- Develop and maintain secure architecture designs that comply with federal security standards and protect confidentiality, integrity, and availability.
- Collaborate with the Cloud Infrastructure Architect and application developers to integrate security controls into system design and implementation.
- Apply security-by-design principles and ensure software, systems, and infrastructure meet security requirements.
- Conduct risk assessments and develop and implement risk mitigation strategies.
- Maintain current and accurate security documentation, including System Security Plans (SSPs) and Risk Management Framework (RMF) artifacts.
- Perform vulnerability assessments and penetration testing, and identify and remediate security weaknesses.
- Assist with preparing and executing Authorization and Accreditation (A&A) packages in accordance with NIST RMF.
- Work with the Authorizing Official (AO) to support timely system authorization and maintain accurate authorization status.
- Assist with incident response, including investigating and reporting security breaches, unauthorized access, and other incidents.
- Lead forensic investigations, determine incident root causes, and recommend remediation.
- Prepare post-incident reports documenting findings and actions to prevent future incidents.
- Develop and deliver security awareness training for staff and stakeholders.
- Promote a security-first mindset across the program.
- Perform other duties as assigned.
Benefits
- Broad range of benefits; specific benefits are not listed.
- Well-being programs.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
