Senior Security Control Assessor

Quantum Sky•Washington, DC

21d•$115,000 - $130,000•Onsite

About The Position

Quantum Sky is seeking a mid-level Security Control Assessor to support a federal customer in Washington, DC. The role evaluates information systems for compliance with FISMA, NIST, and agency security requirements by conducting security control assessments, documenting objective evidence, and communicating risk clearly and actionably. The assessor collaborates with technical teams, system owners, and stakeholders while maintaining quality, accuracy, and professionalism throughout the assessment process. The position supports RMF Steps 4 (assess), 5 (authorize), and 6 (monitor controls), including system security assessments, authorization-to-operate support, and annual assessments. It produces system-specific assessment deliverables and conducts control-level security testing across system components. The assessor analyzes technical security reports and artifacts, evaluates findings and residual risk, and documents system-specific risk analysis and recommendations in Security Assessment Reports and assessment or authorization briefings.

Requirements

Bachelor’s degree and at least four years of experience supporting cybersecurity, information assurance, or Governance, Risk, and Compliance activities within the NIST RMF lifecycle; alternatively, a high school diploma with eight years of experience in the functional responsibility area may substitute for a bachelor’s degree.
PMP, ISO 27001, or CISM certifications each equate to three years of experience in the functional responsibility area.
ITIL, CISSP, or other relevant IT management certifications each equate to two years of general experience.
Thorough knowledge of FISMA, the NIST RMF, and Security Assessment and Authorization processes.
Demonstrated knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-53A Rev. 5, and NIST SP 800-137.
Experience assessing security controls and evaluating the effectiveness of technical, operational, and management safeguards.
Ability to assess the severity of weaknesses and deficiencies, communicate risk effectively, and recommend appropriate corrective actions.
Strong critical-thinking, analytical, and problem-solving skills, with exceptional attention to detail.
Ability to balance security requirements with operational and mission objectives.
Excellent technical writing skills, including experience developing assessment reports and documenting security findings.
Strong verbal communication and interpersonal skills, with the ability to collaborate effectively with technical teams, system owners, and stakeholders.
U.S. citizenship and eligibility for Public Trust clearance.

Nice To Haves

Certified Authorization Professional (CAP).
Certified in Risk and Information Systems Control (CRISC).
Experience with GRC tools such as ServiceNow or CSAM.

Responsibilities

Support RMF Steps 4, 5, and 6 by conducting system security assessments, supporting the system security authorization-to-operate process, and conducting annual assessments.
Produce quality security assessment deliverables that are specific to the systems assessed, complete, and accurate.
Develop and execute a security and privacy assessment plan for each security assessment project.
Create and maintain test cases for security assessment testing.
Perform control-requirement-level security testing for each unique component of each system, including applications, servers, financial systems, databases, operating systems, specialized appliances, network and infrastructure devices, and end-user devices.
Review and analyze technical reports from vulnerability scanning, penetration testing, and configuration compliance tools in the context of the subject system and environment.
Analyze security tool reports and artifacts to determine residual risk or false positives before assigning findings.
Document concise, system-specific, actionable findings and recommendations.
Perform and document client- and system-specific risk analysis for each finding in accordance with NIST SP 800-30, the client’s risk appetite, and security policies.
Document risk analysis results in the Security Assessment Report for each assessed FISMA system and provide a summary of assessment results and risk in the respective Assessment/Authorization Briefing.