FedRAMP & NIST RMF Security Control Lead

Steampunk, Inc.; McLean (VA); On-site; USD 105,000 - 160,000; Full time

Job summary

Steampunk, Inc. is seeking a Security Control Assessor to support a government customer, ensuring risk remains at an acceptable level across cloud, on-premises, and hybrid environments.

You will lead assessments in accordance with NIST SP 800-53, RMF, FedRAMP, and agency guidance, reviewing artifacts and presenting findings to Authorization Officials. Ideal candidates have a Bachelor’s degree with 5 years of relevant experience (or 9 years without a degree), CISSP/CASP/CISA/CISM certifications,

Qualifications

• Bachelor's Degree or equivalent experience as specified in the posting.
• 5 years of relevant experience; or 9 years without degree; or 3 years with a Master’s degree.
• Certifications CISSP, CASP, CISA, CISM.
• Strong knowledge of NIST SP 800-53, FIPS 199/200, and NIST SP 800-30/37/39/53/60; DHS Directive 4300A.
• Hands-on experience reviewing security control artifacts for systems including cloud environments (AWS, Azure).
• Proficiency with assessment/scanning tools and interpreting vulnerabilities.

Responsibilities

• Lead security assessments per NIST RMF/SP 800-53 and FedRAMP.
• Evaluate controls across cloud, on-premises, and hybrid environments.
• Develop Assessment Plans and SARs; document findings and risk.
• Coordinate with ISSOs and Authorizing Officials to remediate deficiencies.
• Analyze vulnerability scans and penetration test results to inform remediation.
• Present findings to management and Authorizing Officials.
• Support continuous monitoring and authorization.

Skills

CISSP

CASP

CISA

CISM

Education

Bachelor's Degree + 5 years relevant experience; OR no degree with 9 years; OR Master's + 3 years

Tools

Nessus

Tenable.SC

Splunk

SCAP scanners

AWS

Azure

Job description

Steampunk, Inc. is seeking a Security Control Assessor to support a government customer, ensuring risk remains at an acceptable level across cloud, on-premises, and hybrid environments.

You will lead assessments in accordance with NIST SP 800-53, RMF, FedRAMP, and agency guidance, reviewing artifacts and presenting findings to Authorization Officials. Ideal candidates have a Bachelor’s degree with 5 years of relevant experience (or 9 years without a degree), CISSP/CASP/CISA/CISM certifications,