Security Control Assessor

Booz Allen Hamilton•Herndon, VA

2d•$99,000 - $225,000

About The Position

The Security Control Assessor evaluates security controls, conducts system assessments, and supports compliance across complex technical environments for a U.S. government client. The role reviews and validates control effectiveness, identifies deficiencies, assesses residual risk, guides stakeholders through the Risk Management Framework (RMF), and provides recommendations that inform authorization decisions. The assessor performs in-depth assessments of complex systems by reviewing security documentation, validating implemented controls, and identifying missing details. The position analyzes technical evidence and evolving cybersecurity threats, cloud technologies, and emerging architectures to identify weaknesses, recommend remediation, and help systems meet authorization requirements. It also applies security engineering principles, cloud security posture knowledge, and risk analysis to produce assessment reports that support authorization decisions and strengthen security. The role supports cloud security and cybersecurity hygiene for a government client with a high operational tempo. Work includes implementing infrastructure and cybersecurity controls, conducting risk and vulnerability assessments, and using security-event data and analytics to identify advanced threats or indicators of compromise. The position requires TS/SCI clearance with polygraph.

Requirements

At least 5 years of experience using and applying NIST Special Publication 800-53.
Experience conducting security control assessments, including documentation review, interviews, and technical testing.
Knowledge of technology security controls and the network accreditation process.
TS/SCI clearance with a polygraph.
High school diploma or GED.

Nice To Haves

Experience with cloud networking providers, including Amazon Web Services (AWS), Oracle, Microsoft, or Google.
Experience with assessment or authorization tools such as Xacta.
Experience with scanning tools, including Nessus, Rapid7, or Nipper.
Experience monitoring and assessing risk on Plans of Action and Milestones (POA&M) items.
Experience communicating complex security topics to a wide variety of audiences, including senior management.

Responsibilities

Review and validate the effectiveness of security controls, identify deficiencies, and assess residual risk.
Guide stakeholders through the Risk Management Framework (RMF).
Conduct comprehensive security control assessments, including security documentation review, interviews, and technical testing.
Evaluate security documentation, validate implemented controls, and identify missing details.
Identify security weaknesses and recommend remediation strategies to help systems meet authorization requirements.
Deliver assessment reports and authoritative recommendations that inform authorization decisions.
Implement infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises.
Perform risk and vulnerability assessments in network, system, and application areas.
Use big data analytics and traditional security event types to identify advanced threats or indicators of compromise.
Support cloud security and cybersecurity hygiene for a government client.