Security Control Assessor

Peraton • Linthicum, MD

1d • Onsite

About The Position

Peraton is seeking a Security Control Assessor to support a Department of Defense customer from its Linthicum, Maryland office. The role is part of a highly talented, motivated, and collaborative team working on cybersecurity, digital forensics, cyber threat analysis, and mission support. The successful candidate will help protect national security interests by applying technical expertise, analytical skills, and problem-solving to complex cyber challenges.

The position focuses on assessing security controls and facilitating risk mitigation for ARCYBER cloud infrastructure. The assessor will support Assessment and Authorization (A&A), maintain security documentation, review vulnerability findings and remediation, and help organizations address privacy and cybersecurity program gaps. The role also involves scanning, testing, and validating systems, networks, and applications to obtain or maintain an Authority to Operate (ATO) under NIST and FISMA guidelines.

Peraton describes itself as a national security company and mission capability integrator serving essential government agencies and every branch of the U.S. armed forces. The target salary range is $135,000–$216,000. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Requirements

• Bachelor’s degree and 8+ years of experience, or a master’s degree and 6+ years of experience, or a Ph.D. and 3+ years of experience. An additional four years of relevant experience or specialized training may be considered in lieu of a bachelor’s degree.
• Active TS clearance with SCI eligibility.
• Active CompTIA Security+ certification.
• Active IAM Level III certification, such as CISM.
• Knowledge of enterprise solutions across multiple cloud operating environments, including JWICS, SIPRNET, NIPRNET, and commercial Internet.
• Experience with eMASS and ACAS, and experience with ISC2 Certified Cloud Computing Professional (CCSP) or CompTIA Cloud+.
• Knowledge of computer networking and/or cloud computing concepts, protocols, and network security methodologies.
• Knowledge of cyber threats and vulnerabilities in virtualized environments.
• Knowledge of national and international cybersecurity laws, regulations, policies, and ethics.
• Knowledge of risk management framework processes, including methods for assessing and mitigating risk.
• Knowledge of the operational impacts of cybersecurity lapses.
• Knowledge of industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures using standards-based concepts and capabilities.
• Knowledge of cyber defense and vulnerability assessment tools, including open-source tools, and their capabilities.
• Knowledge of cybersecurity principles and organizational requirements concerning confidentiality, integrity, availability, authentication, and non-repudiation.
• Knowledge of cybersecurity principles for managing risks related to the use, processing, storage, and transmission of information or data in a cloud environment.
• Knowledge of IT and cloud computing security principles and methods, such as firewalls, demilitarized zones, and encryption.
• Knowledge of known vulnerabilities described in alerts, advisories, errata, and bulletins.
• Knowledge of network and/or cloud security architecture concepts, including topology, protocols, components, and principles such as defense in depth.
• Knowledge of penetration-testing principles, tools, and techniques.
• Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and SQL injection, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
• Knowledge of the Security Assessment and Authorization process.
• Skill in determining how a security or cloud security system should work, including its resilience and dependability, and how changes in conditions, operations, or the environment affect outcomes.
• Skill in discerning the protection needs and security controls of information systems, networks, and cloud computing environments.
• Knowledge of specialized local system requirements, including those for critical infrastructure that may not use standard IT, concerning safety, performance, and reliability.
• Knowledge of new and emerging IT and cybersecurity technologies, including technologies specific to cloud computing.

Nice To Haves

• A degree in Information Technology, Computer Science, Cybersecurity, Information Systems, Software Engineering, Mathematics, or Data Science is highly desired.

Responsibilities

• Conduct assessments and facilitate risk mitigation planning.
• Provide Assessment and Authorization (A&A) for ARCYBER cloud infrastructure.
• Execute a security control assessment plan and update the System Security Plan.
• Review vulnerability scans and remediation.
• Implement risk management programs using NIST, FISMA, HIPAA, and PII requirements, and document solutions.
• Monitor privacy matters related to data privacy, protection, classification, and residency.
• Assist clients in identifying gaps in existing privacy programs and designing solutions to address them.
• Scan, test, and validate systems, networks, and applications to obtain or maintain an ATO under NIST/FISMA guidelines.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior