Security Control Assessor

CALIBRE Systems, Inc.•Glendale, CO

76d

About The Position

CALIBRE is seeking a mid-level Security Control Assessor to conduct independent, comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by IT systems. The assessor determines the overall effectiveness of controls as defined in NIST 800-37. The position has a stated salary of $110,000.

Responsibilities

Manage and approve accreditation packages.
Plan and conduct security authorization reviews and develop assurance cases for the initial installation of systems and networks.
Review authorization and assurance documents to confirm that risk levels are acceptable for each software application, system, and network.
Verify that application, network, and system security postures are implemented as stated; document deviations and recommend corrective actions.
Develop security compliance processes and/or audits for external services, such as cloud service providers and data centers.
Establish acceptable limits for software applications, networks, and systems.
Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.
Identify security architecture gaps and recommend items for inclusion in the risk mitigation strategy.
Perform risk analysis, including threat, vulnerability, and probability-of-occurrence analysis, when an application or system undergoes a major change.
Provide input to Risk Management Framework process activities and related documentation, including system life-cycle support plans, concepts of operations, operational procedures, and maintenance training materials.
Verify and update security documentation to reflect application and system security design features.
Participate in the Risk Governance process by providing security risks, mitigations, and input on other technical risks.
Ensure plans of action and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, and other reviews.
Assure successful implementation and functionality of security requirements and IT policies and procedures consistent with the organization's mission and goals.
Define and document how a new system or new interfaces between systems affect the current environment's security posture.