Federal Security Controls Assessor (NIST 800-53) – Onsite

Evolver Federal; Washington (District of Columbia); On-site; USD 110,000 - 170,000; Full time

Job summary

Evolver is seeking a Security Control Assessor to support a federal client in Washington, DC. The role requires on-site work five days a week at the client’s HQ in DC, performing independent security control testing for 20 FIPS Moderate and Low systems.

Responsibilities include developing assessment plans, reviewing artifacts, and presenting results to government stakeholders such as System Owners, ISSOs, and the CISO, with focus on risk-based recommendations and POA&M tracking.

Qualifications

• Bachelor's degree in computer science, Information Technology, or a related field.
• 4 years of experience in conducting security testing in accordance with NIST SP 800-53A.
• 4 years of experience creating POA&Ms in the CSAM tool.
• 2 years of experience with NIST SP 800-53-A and security control assessment methodologies.
• 2 years of experience with security program management, including policy and procedure development, Continuous Monitoring, and risk management.
• US Citizen with the ability to pass a comprehensive background check.
• 2 years of previous client-engagement experience.

Responsibilities

• Conduct security testing in accordance with NIST SP 800-53-A.
• Develop Security Controls Assessment Plans, including interviewing, examining, and/or testing management, operational, and technical controls.
• Gather evidence for tested controls.
• Summarize testing results and highlight high/moderate risk items and compliance percentages.
• Document results within the Security Controls Assessment Plan.
• Analyze and summarize scan results, using cloud environment scans.
• Assist in updating the client's IT Security Program policies and procedures.
• Provide timely reminders to Agency ISSOs to support Continuous Monitoring.
• Assist in launching the Configuration Management program with DISA STIG guidance.
• Produce Security Assessment Reports (SAR) using the Agency's IA tool.
• Evaluate risk of SAR findings and summarize into POA&M tracking.
• Track IT Risk Management progress via POA&M updates and data submission.
• Review artifacts, evaluate remediation, and recommend POA&M closure.

Skills

Security testing

NIST SP 800-53A

POA&M

CSAM tool

Client engagement

Background check

Education

Bachelor's degree in computer science, Information Technology, or related field

Tools

CSAM tool

Security scanning tools

Microsoft Office

Job description

Evolver is seeking a Security Control Assessor to support a federal client in Washington, DC. The role requires on-site work five days a week at the client’s HQ in DC, performing independent security control testing for 20 FIPS Moderate and Low systems.

Responsibilities include developing assessment plans, reviewing artifacts, and presenting results to government stakeholders such as System Owners, ISSOs, and the CISO, with focus on risk-based recommendations and POA&M tracking.