Security Control Assessor - Intermediate

Rividium•Saint Louis, MO

11d

About The Position

RiVidium Inc. is seeking an Intermediate Security Control Assessor to conduct independent, comprehensive assessments of management, operational, and technical security controls and control enhancements used by or inherited by IT systems, determining their overall effectiveness as defined in NIST 800-37. The role includes managing and approving accreditation packages; planning and conducting security authorization reviews and assurance case development; assessing risk and control effectiveness; and supporting Risk Management Framework and Risk Governance activities. The assessor documents security posture, gaps, deviations, mitigations, and compliance findings, and supports implementation of security requirements and applicable IT policies and procedures.

Requirements

Bachelor's degree or higher from an accredited college or university.
IAT Level 2 certification.
TS/SCI clearance.
Ability to identify systemic security issues by analyzing vulnerability and configuration data.
Ability to communicate clearly and concisely, ask clarifying questions, and communicate complex information confidently and in an organized manner verbally, in writing, and/or visually.
Ability to communicate effectively in writing and produce technical documentation.
Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.
Ability to facilitate small-group discussions and prepare and present briefings.
Ability to design valid and reliable assessments; analyze, collect, verify, and validate test data; and translate test results into evaluative conclusions.
Ability to examine interrelationships among data, identify basic common coding flaws at a high level, and evaluate information for reliability, validity, and relevance.
Ability to ensure security practices are followed throughout the acquisition process.
Ability to apply collaborative skills and strategies, including effective collaboration via virtual teams.
Ability to apply critical reading and thinking skills.
Ability to evaluate, analyze, and synthesize large quantities of potentially fragmented or contradictory data into high-quality, fused targeting or intelligence products.

Nice To Haves

Accredited degree in Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering.
Degree in a Mathematics or Engineering field.

Responsibilities

Manage and approve accreditation packages, including packages referenced to ISO/IEC 15026-2.
Plan and conduct security authorization reviews and assurance case development for initial system and network installations.
Review authorization and assurance documents to confirm risk is within acceptable limits for software applications, systems, and networks.
Verify that application, network, and system security postures are implemented as stated; document deviations and recommend corrective actions.
Develop security compliance processes and audits for external services such as cloud service providers and data centers.
Establish acceptable limits for software applications, networks, and systems.
Perform security reviews, identify security architecture gaps, and develop security risk management plans and recommendations for risk mitigation strategies.
Perform risk analyses, including threat, vulnerability, and likelihood of occurrence, when applications or systems undergo major changes.
Provide input to Risk Management Framework activities and related documentation, including system life-cycle support plans, concepts of operations, operational procedures, and maintenance training materials.
Verify and update security documentation to reflect application and system security design features.
Participate in Risk Governance by providing security risks, mitigations, and input on other technical risks.
Ensure plans of action and milestones or remediation plans address vulnerabilities identified through risk assessments, audits, and inspections.
Assure successful implementation and functionality of security requirements and IT policies and procedures consistent with organizational mission and goals.
Document how new systems or interfaces between systems affect the current environment's security posture.
Ensure security design and cybersecurity development activities are documented, including functional descriptions of security implementation, and updated as necessary.
Support compliance activities, including following system security configuration guidelines and monitoring compliance.
Ensure acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organizational goals.
Assess the effectiveness of security controls.
Assess configuration management processes, including change configuration and release management.