Cyber Security Control Assessor - RMF/NIST Expert

CACI International; Washington; On-site; USD 87,000 - 182,000; Full time

Benefits offered by this job

Flexible time off

Learning resources

Comprehensive benefits

Job summary

CACI International is seeking a Cyber Security Control Assessor to support FEMA OCISO in Washington, DC. You will independently assess security controls, evaluate SSPs, policies, and evidence artifacts, and provide findings to improve risk posture across systems and authorization boundaries.

The role emphasizes evaluating IT security controls under NIST SP 800-53 and DHS RMF, performing interviews, examinations, and testing, and supporting continuous monitoring and authorization efforts.

Qualifications

• U.S. Citizenship required
• FEMA EOD suitability or current DHS or FEMA EOD preferred
• BS/BA + 6 years of RMF, control assessment, audit, cybersecurity compliance, or security engineering
• Knowledge of NIST SP 800-53, 800-37 (RMF), and DHS 4300 Series
• Experience with security control assessment methodologies and tools
• Knowledge of scanning tool results (Tenable, Qualys, dbProtect), CSAM, STIG Viewer, and RMF tools

Responsibilities

• Evaluate the effectiveness of IT security controls and determine RMF/compliance against NIST SP 800-53 and DHS RMF
• Perform assessment procedures including interviews, examinations, and testing
• Analyze SSPs, policies, procedures, and evidence artifacts
• Identify security gaps and evaluate residual risk; generate assessment findings
• Support authorization to operate and continuous monitoring activities
• Provide information assurance for digital information and training on security awareness

Skills

RMF knowledge

NIST SP 800-53

Security assessment

Tool knowledge (CSAM, STIG)

Education

BS/BA + 6 years experience

Tools

Tenable

Qualys

dbProtect

CSAM

STIG Viewer

eMASS

Job description

CACI International is seeking a Cyber Security Control Assessor to support FEMA OCISO in Washington, DC. You will independently assess security controls, evaluate SSPs, policies, and evidence artifacts, and provide findings to improve risk posture across systems and authorization boundaries.

The role emphasizes evaluating IT security controls under NIST SP 800-53 and DHS RMF, performing interviews, examinations, and testing, and supporting continuous monitoring and authorization efforts.