Senior Cybersecurity Control Assessor

CACI • Washington Dc, DC

8d • Onsite

About The Position

CACI is searching for a Senior Cyber Security Control Assessor to support the FEMA Office of the Chief Information Security Officer (OCISO) in Washington, D.C. As a Senior Cyber Security Control Assessor, you will play a crucial role in ensuring the security and compliance of FEMA's information systems through comprehensive independent assessment of security controls. You will work in a dynamic environment, collaborating with system owners, ISSOs, stakeholders, and cybersecurity professionals to evaluate the effectiveness of security control implementation. Your efforts will directly contribute to safeguarding FEMA's mission-critical systems and data. The Senior Cyber Security Control Assessor will serve as an independent assessor for control design, implementation, and effectiveness across assigned systems and authorization boundaries. This position requires evaluating the effectiveness of IT security controls including management, operational, and technical controls and determining if controls meet compliance requirements under NIST SP 800-53 Rev 5 and DHS RMF. The Senior Cyber Security Control Assessor will perform assessment procedures including interviews, examinations, and testing and verify control implementation and effectiveness. This role is critical for analyzing System Security Plans (SSPs), policies, procedures, and evidence artifacts to identify security gaps and evaluate residual risk. This role requires a deep understanding of cybersecurity frameworks, standards, and best practices. The assessor will work closely with various teams to identify gaps, recommend improvements, and ensure compliance with regulatory requirements.

Requirements

• U.S. Citizenship required
• BS/BA + 7 years of applicable experience in RMF, control assessment, audit, cybersecurity compliance, or security engineering
• Certifications such as CISSP, CISM, CISA, or equivalent
• Strong knowledge in NIST SP 800-53, NIST SP 800-37 (RMF), and DHS 4300 Series
• Experience with security control assessment methodologies and tools
• Experience conducting security assessments and generating Security Assessment artifacts (Security Assessment Plans (SAPs), Risk Traceability Matrices (RTMs), and Security Assessment Reports (SARs))
• Strong analytical skills for identifying security gaps and evaluating residual risk
• Knowledge of assessment methodologies and risk analysis
• Experience developing POA&Ms
• Excellent analytical and problem-solving skills for vulnerability prioritization and trend analysis
• Strong communication and interpersonal skills.
• Ability to work independently and as part of a team.
• Detail-oriented with a commitment to accuracy and thoroughness.

Nice To Haves

• FEMA EOD suitability or Current DHS or FEMA EOD preferred
• Active Secret security clearance
• Previous DHS or DoD experience
• Experience with CSAM, RegScale, eMASS, or similar GRC tools
• Knowledge of FedRAMP assessment processes, DISA STIGs and cybersecurity compliance frameworks
• Experience with continuous monitoring and ongoing authorization activities
• Knowledge of cloud security and emerging technologies
• Strong technical writing skills for assessment documentation
• Experience supporting audit activities and authorization decisions

Responsibilities

• Evaluate the effectiveness of IT security controls and determine if controls meet compliance requirements under NIST SP 800-53 Rev 5 and DHS RMF.
• Perform comprehensive assessments of cybersecurity controls within a system boundary and across FEMA to include interviews, examinations, and testing to verify control implementation and effectiveness.
• Evaluate the effectiveness of existing security policies, procedures, and technologies and identify vulnerabilities and risks.
• Review and analyze System Security Plans (SSPs), policies, procedures, and evidence artifacts for completeness and accuracy.
• Identify security gaps and evaluate residual risk.
• Generate findings for security assessment reports.
• Develop and maintain the appropriate assessment artifacts and document assessment findings.
• Support continuous monitoring activities and ongoing authorization efforts, highlighting findings and recommendations.
• Collaborate with IT, security, and business units to implement corrective actions.

Benefits

• flexible time off
• robust learning resources
• comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior