Security Control Assessor

M9 Solutions•Alexandria, VA

2d•$137,000 - $152,000•Onsite

About The Position

M9 Solutions is seeking a Security Control Assessor to work on-site in Alexandria, Virginia, supporting a government contract. The role provides tailored documentation for security authorization and serves as an independent assessor across Risk Management Framework Steps 0 through 7. An active Secret security clearance is required. The assessor plans and conducts security control assessments, evaluates control effectiveness, identifies vulnerabilities and risks, documents findings in Security Assessment Reports, and works with system owners, ISSOs, and other stakeholders. The position also supports System Security Plans and Plans of Action and Milestones, verifies remediation, and performs continuous monitoring activities. Compensation is listed at $137,000–$152,000 per year. The posting refers applicants to M9 Solutions’ benefits page but does not specify individual benefits.

Requirements

Active Secret security clearance.
Bachelor’s degree or equivalent years of relevant experience.
At least 5 years of relevant experience.
One of the following certifications: CCNA Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
Intimate understanding of NIST Risk Management Framework implementation guidance.
Hands-on experience with eMASS or similar Information Assurance tools.
Experience analyzing vulnerability scans and STIG implementations.
Hands-on experience assessing RMF Step 4 and performing continuous monitoring.
Deep understanding of vulnerability management practices.

Responsibilities

Provide tailored documentation to support the client's security authorization.
Serve as an independent assessor for Risk Management Framework Steps 0 to 7.
Plan and execute security control assessments for information systems.
Develop and maintain assessment procedures and methodologies aligned with NIST guidelines and other relevant frameworks.
Analyze and evaluate the effectiveness of implemented security controls.
Identify vulnerabilities, weaknesses, and potential risks in information systems and infrastructure.
Prepare Security Assessment Reports documenting findings and recommendations.
Collaborate with system owners, ISSOs, and other stakeholders throughout the assessment process.
Verify remediation actions and conduct follow-up assessments as needed.
Provide expert advice on developing and maintaining System Security Plans and Plans of Action and Milestones.
Stay current with cybersecurity threats, technologies, and best practices.
Validate security control implementation and provide test results.
Examine security control weaknesses and determine whether controls are producing their intended results.