SBA - Security Control Assessor

cFocus Software Incorporated•Washington, DC

About The Position

The Security Control Assessor (SCA) shall provide cybersecurity assessment, authorization, and compliance support services for the U.S. Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program.

Requirements

Bachelor’s degree in Cybersecurity, Information Assurance, Information Technology, Computer Science, Engineering, or related field.
Minimum of six (6) years of experience supporting federal cybersecurity assessment, compliance, RMF, or security authorization activities.
Minimum of four (4) years of experience conducting security control assessments, vulnerability assessments, or cybersecurity compliance evaluations.
Demonstrated expertise in NIST RMF processes, NIST SP 800-53 Rev. 5, NIST SP 800-53A, and FISMA compliance requirements.
Experience developing Security Assessment Reports (SARs), Security Assessment Plans (SAPs), POA&Ms, and related accreditation documentation.
Experience supporting continuous monitoring, ongoing authorization (OA), and cybersecurity audit activities.
Knowledge of FedRAMP security assessment and continuous monitoring requirements.
Experience using cybersecurity assessment, vulnerability management, and governance/risk/compliance (GRC) tools.
Strong analytical, technical writing, and communication skills.
Ability to obtain and maintain a Moderate Risk background investigation and eligibility for higher-level clearances if required.

Nice To Haves

Relevant cybersecurity certifications such as CAP, CISSP, CISA, Security+, CEH, or equivalent preferred.
Experience supporting civilian federal agencies such as SBA, DHS, or CISA.
Experience supporting FedRAMP cloud environments including Microsoft Azure, AWS, Microsoft 365, and SaaS platforms.
Experience supporting enterprise cybersecurity metrics, dashboards, and automated compliance reporting.

Responsibilities

Conduct independent security control assessments in accordance with NIST SP 800-53 Rev. 5 and NIST SP 800-53A methodologies.
Evaluate management, operational, and technical security controls for federal information systems and cloud environments.
Support the SBA Risk Management Framework (RMF) lifecycle including assessment, authorization, continuous monitoring, and ongoing authorization activities.
Develop and maintain Security Assessment Reports (SARs), Security Assessment Plans (SAPs), POA&Ms, risk findings, and remediation recommendations.
Review and validate cybersecurity documentation including System Security Plans (SSPs), Configuration Management Plans (CMPs), Incident Response Plans, ISCPs, and architecture diagrams.
Perform vulnerability assessment validation activities and verify remediation efforts for identified weaknesses and deficiencies.
Support Information System Continuous Monitoring (ISCM) activities and ongoing authorization (OA) evaluation support.
Assess compliance with FISMA, OMB Circular A-130, NIST guidance, FedRAMP requirements, and agency-specific cybersecurity policies.
Support audit readiness activities for Inspector General (IG), GAO, FISMA, and internal cybersecurity audits.
Assist with High Value Asset (HVA) assessment support activities in alignment with CISA and OMB guidance.
Coordinate with ISSOs, ISSMs, system owners, and engineering teams to evaluate cybersecurity risks and remediation strategies.
Support enterprise vulnerability management and risk reporting activities.
Participate in cybersecurity governance meetings, compliance reviews, and technical assessment briefings.
Document assessment findings, technical analysis, and recommendations with clear and concise reporting suitable for executive and technical stakeholders.
Support development of cybersecurity metrics, dashboards, and compliance reporting artifacts.
Ensure all assessment deliverables are peer reviewed, Section 508 compliant, and delivered in accordance with SBA-defined quality standards and timelines.