Security Controls Assessor / OSCAL (Part Time, Remote)
About The Position
TestPros delivers innovative independent IT assessment solutions to critical challenges facing the nation and the world. We support the U.S. Federal Government and Commercial clients within the continental USA. TestPros is dedicated to making lives better, safer and more secure. This is a part-time consulting role for future projects expected to start in late 2026 or 2027. The ideal candidate will have strong hands-on experience conducting independent security control compliance assessments using guidelines from NIST (800-53, 800-171) and assessment automation via OSCAL (Open Security Controls Assessment Language). You must have security controls and OSCAL experience in both U.S. Government and Commercial environments. FedRAMP experience is a plus.
Requirements
- Proven OSCAL experience (at least two years).
- 5+ years of hands-on security controls assessment.
- Experience with RegScale, Paramify, or similar tools.
- Experience with government, public sector, or municipal IT environments is highly preferred.
- Ability to write clear, professional, and actionable technical reports.
- Full U.S. Citizenship.
- Ability to pass an extensive background check.
Nice To Haves
- FedRAMP experience.
- Experience with NIST 800-53 based ATO assessment.
- Experience with NIST 800-171/CMMC assessment.
- Experience with HIPAA assessment.
- Familiarity with U.S. Government security policy requirements.
- Expertise with common tools such as Kali Linux, Burp Suite, Nmap, Metasploit, Nessus/Tenable, and Wireshark.
Responsibilities
- Conduct independent security control compliance assessments using NIST (800-53, 800-171) guidelines.
- Utilize OSCAL for assessment automation.
- Develop Security Assessment Plan (SAP), Security Assessment Report (SAR), and Plan of Actions and Milestones (POA&M).
- Write clear, professional, and actionable technical reports.
- Produce a set of interoperable, extensible, machine-readable formats that supports a broad range of control-based risk management processes (XML-, JSON-, and YAML-based formats that allow for lossless translations between XML, JSON, and YAML representations).
- Coordinate with multi-agency or cross-organizational IT teams.
Benefits
- Medical/dental/vision insurance
- Life insurance
- Paid time off
- Paid holidays
- 401(k) retirement plan with company match
- Opportunities for professional growth
- Cell phone discounts
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Part-time
Career Level
Mid Level
Education Level
No Education Listed
