Security Control Assessor

Evolver Federal • Washington, DC

2d • Onsite

About The Position

Evolver is seeking a Security Control Assessor to support a federal client in Washington, DC. The position is on-site five days per week at the client’s headquarters. The assessor provides independent security control testing for 20 FIPS Moderate and Low systems, assessing applicable management, operational, and technical controls through interviews, examination, and testing. The role includes analyzing and validating findings and test results; developing Security Control Assessment Plans, Risk Assessment Reports, and ATO Memos; and developing and maintaining testing policies and related Standard Operating Procedures.

The assessor documents and presents Security Test & Evaluation (ST&E) results to government stakeholders, including System Owners, ISSOs, the CISO, and the Authorizing Official. The role also reviews supporting artifacts, evaluates remediation, and recommends POA&M closures. Additional work includes supporting continuous monitoring and risk-management activities, analyzing scan results, and assisting with the client’s Configuration Management program and implementation of DISA STIGs.

Requirements

• Bachelor’s degree in computer science, Information Technology, or a related field.
• Four years of experience conducting security testing in accordance with NIST SP 800-53A.
• Four years of experience creating POA&Ms in the CSAM tool.
• Two years of experience with NIST SP 800-53-A and security control assessment methodologies.
• Two years of experience with security program management, including policy and procedure development, Continuous Monitoring, and risk management.
• U.S. citizenship and ability to pass a comprehensive background check.
• Two years of previous client-engagement experience.

Nice To Haves

• Strong analytical skills and ability to quantify and analyze test findings.
• Knowledge of security tools and techniques, including scanning tools.
• Understanding of cloud environments and related security implications.
• Excellent verbal and written communication and collaboration skills, including ability to work effectively with security staff and Agency ISSOs.
• Strong work ethic, sound decision-making, integrity, and accountability.
• Excellent organizational skills and attention to detail.
• Strong analytical, critical-thinking, and problem-solving skills.
• Ability to work in a fast-paced and sometimes stressful environment and prioritize tasks.
• Proficiency with Microsoft Office Suite, particularly Excel, Word, and Outlook.
• One or more of the following certifications: CISSP, CAP, CISM, Security+, CASP, or CISA.

Responsibilities

• Conduct security testing in accordance with NIST SP 800-53-A.
• Develop Security Control Assessment Plans by interviewing, examining, and/or testing management, operational, and technical controls; gathering evidence; summarizing results and risk items; identifying compliance percentages; and documenting results.
• Analyze and summarize scan results provided by the cloud environment.
• Assist in updating the client’s IT Security Program policies and procedures.
• Provide timely reminders to Agency ISSOs to support Continuous Monitoring efforts.
• Assist in launching the client’s Configuration Management program, including compliance testing and guidance on implementing DISA Security Technical Implementation Guides (STIGs).
• Produce Security Assessment Reports (SARs) using the Agency’s Information Assurance tool.
• Evaluate risks associated with SAR findings and summarize them in POA&M tracking documentation.
• Track IT Risk Management program progress through POA&M updates and/or data submissions to the Agency’s Office of Risk Management.
• Review supporting artifacts, evaluate risk remediation, and recommend POA&M closure.
• Validate security test results and reports and present ST&E results to government stakeholders.

Benefits

• Health insurance
• Dental insurance
• Vision insurance
• 401(k)
• Flexible spending account
• Paid leave, including PTO and parental leave, in accordance with applicable plans and policies

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level