Independent Cyber Security Control Assessor (RMF/NIST)

CACI; Washington (District of Columbia); On-site; USD 109,000 - 182,000; Full time

Job summary

CACI is seeking a Cyber Security Control Assessor to support FEMA OCISO in Washington, D.C. You will perform independent assessments of security controls across systems to ensure compliance with NIST SP 800-53 and DHS RMF.

You will analyze SSPs, policies, and evidence artifacts, identify gaps, and produce assessment artifacts while supporting continuous monitoring and authorization efforts. Strong technical writing and FEMA/DHS experience preferred.

Qualifications

• U.S. Citizenship required.
• BS/BA with 6 years RMF/security experience.
• Knowledge of NIST SP 800-53, 800-37, and DHS 4300 Series.
• Experience with security control assessment methodologies and tools.
• Experience producing SAPs, RTMs, and SARs.
• Familiarity with CSAM, RegScale, eMASS or similar GRC tools.

Responsibilities

• Evaluate the effectiveness of IT security controls and determine if controls meet NIST SP 800-53 and DHS RMF.
• Perform assessment procedures including interviews, examinations, and testing to verify control implementation and effectiveness.
• Analyze System Security Plans (SSPs), policies, procedures, and evidence artifacts for completeness and accuracy.
• Identify security gaps and evaluate residual risk, and generate findings for assessment reports.
• Review security architecture, identify gaps, and provide risk mitigation recommendations.
• Evaluate technical, operational, and management controls across assigned systems and boundaries.
• Maintain security architecture documentation and provide analyses of security artifacts and risk assessments.
• Support authorization-to-operate processes, monitor vulnerabilities, and assist incident response and remediation.

Skills

RMF control assessments

NIST SP 800-53

NIST SP 800-37 RMF

Security assessments

Risk management

Vulnerability analysis

Policy and documentation

Analytical thinking

Education

Bachelor's degree in a related field

Tools

Tenable

Qualys

dbProtect

CSAM

STIG Viewer

Job description

CACI is seeking a Cyber Security Control Assessor to support FEMA OCISO in Washington, D.C. You will perform independent assessments of security controls across systems to ensure compliance with NIST SP 800-53 and DHS RMF.

You will analyze SSPs, policies, and evidence artifacts, identify gaps, and produce assessment artifacts while supporting continuous monitoring and authorization efforts. Strong technical writing and FEMA/DHS experience preferred.