Security Control Assessor

Peraton•Linthicum, MD

13d•$135,000 - $216,000•Onsite

About The Position

Peraton is seeking a Security Control Assessor for its Linthicum, Maryland office to support a Department of Defense customer. The role is part of a collaborative team working on cybersecurity investigations, digital forensics, cyber threat analysis, and mission support. The successful candidate will apply technical expertise, analytical skills, and problem-solving to address cybersecurity challenges and protect national security interests. The position assesses security controls and supports risk mitigation, Assessment and Authorization for ARCYBER cloud infrastructure, and the maintenance of system security documentation. It also includes reviewing vulnerability scans and remediation, applying risk management frameworks and regulatory requirements, monitoring privacy matters, helping clients improve privacy programs, and testing systems, networks, and applications to obtain or maintain an Authority to Operate (ATO).

Requirements

Bachelor’s degree and 8 or more years of experience, or a master’s degree and 6 or more years of experience, or a Ph.D. and 3 or more years of experience. An additional 4 years of relevant experience or specialized training may be considered in lieu of a bachelor’s degree.
Active TS clearance with SCI eligibility.
Active CompTIA Security+ certification.
Active IAM Level III certification, such as CISM.
Knowledge of enterprise solutions across multiple cloud operating environments, including JWICS, SIPRNET, NIPRNET, and commercial Internet.
Experience with eMASS and ACAS, and with ISC2 Certified Cloud Computing Professional (CCSP) or CompTIA Cloud+.
Knowledge of computer networking and/or cloud computing concepts and protocols, and network security methodologies.
Knowledge of cyber threats and vulnerabilities in virtualized environments.
Knowledge of national and international laws, regulations, policies, and ethics related to cybersecurity.
Knowledge of risk management framework processes, including methods for assessing and mitigating risk.
Knowledge of the operational impacts of cybersecurity lapses.
Knowledge of industry methods and standards for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures.
Knowledge of cyber defense and vulnerability assessment tools, including open-source tools, and their capabilities.
Knowledge of cybersecurity principles and organizational requirements related to confidentiality, integrity, availability, authentication, and non-repudiation.
Knowledge of cybersecurity principles for managing risks related to the use, processing, storage, and transmission of information or data in a cloud environment.
Knowledge of IT and cloud computing security principles and methods, such as firewalls, demilitarized zones, and encryption.
Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.
Knowledge of network and/or cloud environment security architecture concepts, including topology, protocols, components, and principles such as defense in depth.
Knowledge of penetration testing principles, tools, and techniques.
Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and other injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
Knowledge of the Security Assessment and Authorization process.
Skill in determining how security and/or cloud security systems should work, including resilience and dependability, and how changes in conditions, operations, or the environment affect outcomes.
Skill in discerning the protection needs and security controls of information systems, networks, and cloud computing.
Knowledge of specialized local system requirements, such as safety, performance, and reliability needs of critical infrastructure systems that may not use standard IT.
Knowledge of new and emerging IT and cybersecurity technologies, including technologies specific to cloud computing.

Nice To Haves

A degree in Information Technology, Computer Science, Cybersecurity, Information Systems, Software Engineering, Mathematics, or Data Science is highly desired.

Responsibilities

Conduct assessments and facilitate risk mitigation planning.
Provide Assessment and Authorization (A&A) for ARCYBER cloud infrastructure.
Execute a security control assessment plan and update the System Security Plan.
Review vulnerability scans and remediation.
Implement risk management programs using NIST, FISMA, HIPAA, and PII requirements, and document solutions.
Monitor the privacy landscape regarding data privacy, protection, classification, and residency.
Assist clients in identifying gaps in existing privacy programs and designing solutions to address them.
Scan, test, and validate systems, networks, and applications to obtain or maintain an ATO under NIST/FISMA guidelines.