Security Control Assessor

SkyePoint Decisions

2h • Remote

About The Position

SkyePoint Decisions is seeking a Senior Technical Assessor to support the Department of Education’s Federal Student Aid Cybersecurity and Privacy Support Services program. The position is remote and based in support of work in Washington, DC. It is contingent upon contract award.

The assessor evaluates security and privacy controls, plans and conducts system assessments, identifies and rates deficiencies, and develops recommendations and remediation-tracking materials. The role also maintains assessment schedules and program documentation, reviews system artifacts in support of authorization to operate requests, and reports assessment activity, findings, and enterprise security risks to the CISO and other stakeholders.

Requirements

• Must be able to obtain a High Risk/Public Trust security clearance.
• Bachelor’s degree or equivalent and at least 10 years of related experience.
• Senior industry professional certification such as CISSP or equivalent required.
• At least five years of experience as a Security Controls Assessor or in a similar audit findings response role.
• Excellent communication and interpersonal skills.
• Experience with security audits and compliance.
• Experience with IT Review Board change requests.
• Familiarity with relevant government and agency policies and procedures, including FedRAMP, RMF, FISMA, FIPS-II, and NIST.
• U.S. citizenship required.

Nice To Haves

• Active Secret or Top Secret security clearance.

Responsibilities

• Establish information assurance and security requirements based on user, policy, regulatory, and resource demands.
• Assess implemented controls and enhancements to determine whether they are correctly implemented, operating as intended, and achieving security and privacy requirements.
• Schedule and lead system assessment out-briefs with stakeholders; provide SAPs, SARs, security recommendations, and system certifications.
• Prepare security, privacy, and supply chain assessment reports documenting results and findings.
• Assess the severity of deficiencies in systems, operating environments, and common controls, and recommend corrective actions.
• Develop and execute Security Controls Test plans detailing assessment activities, vulnerability scans, penetration testing, coordination, control scope, and special-interest items, aligned with DHS RVA standards, guidelines, and templates.
• Deliver a Final Analysis Report and executive briefing for the CISO, support the Authorizing Official briefing, prepare Summary of Findings and Detailed Findings reports, and provide a POA&M Injection Template for remediation tracking.
• Create or update a three-year OSA test plan for each system using current NIST SP 800-53 control tests and additional OSA tests, ensuring all controls are tested or assessed at least once over three years.
• Maintain the OSA master project schedule using NIST assessment methods and approved OSA procedures.
• Create or update program management documentation, including rules of engagement, schedules, annual document reviews, and processes for POA&M and accepted-risk reviews.
• Ensure vulnerability and penetration tests are scheduled, conducted, analyzed, and presented to system owners and information systems security officers.
• Meet as needed with system ISSOs, systems contractors, and the POA&M Team to develop mitigation strategies and acceptable evidence criteria for closing deficiencies.
• Populate the FSA vulnerability tracking tool injection template for each system’s security deficiencies, completing required fields.
• Review and provide analysis-based advice on Third Party Website and Applications (TPWA).
• Review and analyze system artifacts for accuracy and completeness in support of authorization to operate requests.
• Submit a monthly OSA report to the CISO covering scheduled assessment activities, completed reviews and tests, and residual risks added.
• Rate risk across OSA program systems, identify trends, and recommend enterprise security improvements with sufficient detail.

Benefits

• Certification incentive program
• Paid time off (PTO)
• Floating federal holiday options
• Health insurance options, including HMO and High Deductible plans with Health Savings Accounts
• Flexible Spending Accounts
• Dental insurance
• Vision insurance
• Short- and long-term disability insurance
• Life insurance
• 401(k) matching
• Flexible work environment

What This Job Offers

• Job Type: Full-time
• Career Level: Senior