Security Control Assessor

Booz Allen Hamilton•Herndon, VA

1d•$99,000 - $225,000•Onsite

About The Position

The Security Control Assessor evaluates security controls, conducts system assessments, and supports compliance across complex technical environments for a U.S. government client. The role reviews and validates control effectiveness, identifies deficiencies, assesses residual risk, guides stakeholders through the Risk Management Framework (RMF), and delivers authoritative recommendations that inform authorization decisions. The assessor evaluates security documentation, validates implemented controls, identifies missing details, and analyzes technical evidence. The role uses knowledge of cybersecurity threats, cloud technologies, emerging architectures, security engineering principles, cloud security postures, and risk analysis to identify weaknesses, recommend remediation strategies, and ensure systems meet authorization requirements. The position supports cloud security, cybersecurity hygiene, and national security missions, and includes mentoring, hands-on problem-solving, and opportunities to develop tools and skills.

Requirements

At least 5 years of experience using and applying NIST Special Publication 800-53.
Experience conducting security control assessments, including documentation review, interviews, and technical testing.
Knowledge of technology security controls and the network accreditation process.
TS/SCI clearance with a polygraph.
High school diploma or GED.

Nice To Haves

Experience with cloud networking providers, including Amazon Web Services (AWS), Oracle, Microsoft, or Google.
Experience with assessment or authorization tools such as Xacta.
Experience with scanning tools, including Nessus, Rapid7, or Nipper.
Experience monitoring and assessing risk on Plans of Action and Milestones (POA&M) items.
Experience communicating complex security topics to a wide variety of audiences, including senior management.

Responsibilities

Implement infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises.
Perform risk and vulnerability assessments in network, system, and application areas.
Use big data analytics and traditional security event types to identify advanced threats or indicators of compromise.
Conduct security control assessments, including documentation review, interviews, and technical testing.
Review and validate security controls, identify deficiencies and missing details, and assess residual risk.
Guide stakeholders through the Risk Management Framework (RMF) and provide recommendations that inform authorization decisions.
Recommend remediation strategies and produce assessment reports supporting authorization decisions.