Security Control Assessor

Booz Allen Hamilton•Herndon, VA

4h•$99,000 - $225,000•Onsite

About The Position

The Security Control Assessor evaluates and validates security controls across complex technical environments, identifies deficiencies, and assesses residual risk. The role guides stakeholders through the Risk Management Framework (RMF), conducts comprehensive assessments, and provides authoritative recommendations that inform authorization decisions. Work includes reviewing security documentation, validating implemented controls, identifying missing details, analyzing technical evidence, and documenting assessment results for a U.S. government client supporting cyber operations. The position applies security engineering principles, cloud security knowledge, and risk analysis to identify weaknesses, recommend remediation strategies, and help systems meet authorization requirements. It also supports cloud security and cybersecurity hygiene in a high-operational-tempo environment, while contributing to the client’s overall security posture.

Requirements

5+ years of experience using and applying NIST Special Publication 800-53.
Experience conducting security control assessments, including documentation review, interviews, and technical testing.
Knowledge of technology security controls and the network accreditation process.
TS/SCI clearance with a polygraph.
High school diploma or GED.

Nice To Haves

Experience with cloud networking providers, including Amazon Web Services (AWS), Oracle, Microsoft, or Google.
Experience with assessment or authorization tools such as Xacta.
Experience with scanning tools, including Nessus, Rapid7, or Nipper.
Experience monitoring and assessing risk on Plans of Action and Milestones (POA&M) items.
Experience communicating complex security topics to varied audiences, including senior management.

Responsibilities

Implement infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises.
Perform risk and vulnerability assessments in network, system, and application areas.
Use big data analytics and traditional security event types to identify advanced threats or indicators of compromise.
Conduct security control assessments, including reviewing documentation, interviewing stakeholders, and performing technical testing.
Evaluate security documentation and validate implemented controls across complex systems.
Identify control deficiencies and missing details, assess residual risk, and recommend remediation strategies.
Guide stakeholders through the Risk Management Framework (RMF) and deliver assessment reports that support authorization decisions.