Evolver Federal is looking for a Security Control Assessor to join our team supporting our federal client located onsite in Washington, DC.
This is an hybrid position that requires support up to three days (Tuesday through Thursday) in Washington, DC.
The Security Control Assessor is responsible for providing independent security control testing to the client for ~ 50 FIPS Moderate and Low systems. Duties include conducting security control assessments through interviews, examination, and/or testing for all applicable management, operational, and technical controls, including analyzing findings and results and validating test results/ reports. Duties also include developing Security Control Assessment Plans, Risk Assessment Reports, and ATO Memos, as well as developing and maintaining testing policies and related Standard Operating Procedures (SOPs). The Security Control Assessor is also responsible for documenting and presenting the results of the Security Test & Evaluation (ST&E) to government stakeholders including System Owners, ISSOs, the CISO and Authorizing Official. . Responsibilities also include reviewing artifacts and providing recommendations on POA&M closures.

BASIC REQUIREMENTS

• Bachelor’s degree in computer science, Information Technology, or related field.
• 4 years’ experience in security testing and assessment, preferably in a federal information systems environment.
• 2 years’ experience creating POA&Ms in the CSAM tool.
• 2 years of experience with NIST SP 800-53-A and security control assessment methodologies.
• Must have previous client-engagement experience
• US Citizen, Must be able to pass a comprehensive background check.
• Travel required once per year to sites in WV and PA

PREFERRED REQUIREMENTS

• 6 years’ experience in security testing and assessment, preferably in a federal information systems environment.
• 4 years’ experience creating POA&Ms in the CSAM tool.
• 4 years of experience with NIST SP 800-53-A and security control assessment methodologies.
• One or more of the following certifications preferred: CISSP, CAP, CISM, Security+, CASP, CISA.
• Strong analytical skills and ability to quantify and analyze test findings.
• Knowledge of security tools and techniques, including scanning tools.
• Understanding of cloud environments and their security implications.
• Excellent communication (verbal and written) and collaboration skills, with the ability to work effectively with security staff and Agency ISSOs.
• Work closely with managers to ensure alignment between assessment outcomes and business objectives.
• Experience with security program management, including policy and procedure development, Continuous Monitoring, and risk management.
• Excellent organizational skills and attention to detail.
• Strong analytical, critical thinking, and problem-solving skills.
• Ability to function well in a high-paced and at times stressful environment.
• Ability to prioritize tasks.
• Proficient with Microsoft Office Suite; specifically, Excel, Word, and Outlook a must.
  Evolver Federal is an equal opportunity employer and welcomes all job seekers. It is the policy of Evolver Federal not to discriminate based on race, color, ancestry, religion, gender, age, national origin, gender identity or expression, sexual orientation, genetic factors, pregnancy, physical or mental disability, military/veteran status, or any other factor protected by law

• Conduct security testing in accordance with NIST SP 800-53-A.
• Develop Security Controls Assessment Plans, including:
• Interviewing, examining, and/or testing management, operational, and technical controls.
• Gathering evidence for tested controls.
• Summarizing testing results, highlighting high/moderate risk items and compliance percentages.
• Documenting results within the Security Controls Assessment Plan.
• Analyzing and summarizing scan results, utilizing scans provided by the cloud environment.
• Assist in updating the client’s IT Security Program policies and procedures.
• Provide timely reminders to Agency ISSOs to support Continuous Monitoring efforts.
• Assist in launching the client’s Configuration Management program, including compliance testing and guidance on implementing DISA’s Security Technical Implementation Guides (STIGs).
• Produce Security Assessment Reports (SAR) using the Agency’s Information Assurance tool.
• Evaluate the risk of SAR findings from security testing and summarize them into Plan of Action and Milestone (POA&M) tracking documentation.
• Track the progress of the IT Risk Management program through POA&M updates and/or data submission to the Agency’s Office of Risk Management.
• Review supporting artifacts, evaluate remediation of risk, and recommend POA&M closure.