Federal Security Controls Assessor

Steampunk; McLean (VA); On-site; USD 105,000 - 160,000; Full time

Job summary

Steampunk is seeking a Security Control Assessor to support a government customer, driving risk management and control evaluations across cloud, on‑prem, and hybrid environments. You will develop assessment plans, review evidence, and produce SARs while coordinating with ISSOs and Authorization Officials.

The role requires strong writing and presentation skills, with expertise in NIST SP 800-53, RMF, and security controls under FISMA/FedRAMP.

Qualifications

• Bachelor's degree or higher with 5+ years of relevant security experience.
• Experience reviewing security control artifacts for FedRAMP and NIST RMF.
• Ability to analyze vulnerability scans and pen test results for risk.
• Strong communication with ISSOs, System Owners and Authorization Officials.

Responsibilities

• Lead security assessments per NIST SP 800-53, RMF, FedRAMP and agency guidance.
• Evaluate controls across cloud, on-premises and hybrid environments.
• Develop Assessment Plans and SARs, document findings and risk.
• Coordinate evidence review with stakeholders to remediate deficiencies.
• Analyze vulnerability results to determine control effectiveness and remediation.
• Present findings and risk analysis to management and officials.
• Support continuous monitoring and ongoing authorization.

Skills

NIST 800-53

FIPS 199/200

RMF SP 800-37

IAM/MFA enforcement

Education

CISSP

CASP

CISA

CISM

Tools

Nessus

Tenable.sc

Splunk

SCAP scanners

JIRA

ServiceNow

Okta

Job description

Steampunk is seeking a Security Control Assessor to support a government customer, driving risk management and control evaluations across cloud, on‑prem, and hybrid environments. You will develop assessment plans, review evidence, and produce SARs while coordinating with ISSOs and Authorization Officials.

The role requires strong writing and presentation skills, with expertise in NIST SP 800-53, RMF, and security controls under FISMA/FedRAMP.