Junior Security Control Assessor

tharros; Washington (District of Columbia); On-site; USD 65,000 - 95,000; Full time

Job summary

Tharros, supporting DHS, seeks a Junior Security Control Assessor for on-site work in a Government SCIF in Washington, DC. You will execute security control tests, perform vulnerability scanning, document findings, and help assemble authorization packages under senior guidance.

Requirements include a BS or 4+ years in IT/cybersecurity, 1+ year RMF testing, TS clearance with SCI eligibility, and strong communication skills. Cybersecurity certs and RSA Archer experience are a plus.

Qualifications

• BS degree in IT, Cybersecurity, Information Systems, or Computer Science or 4+ years IT/cybersecurity experience.
• Minimum 1 year RMF security testing or assessment experience.
• Active Top Secret clearance with SCI eligibility contingency.
• Knowledge of RMF and NIST SP 800-53A assessment procedures.
• Knowledge of CNSSI 1253 baselines and related controls.
• Understanding vulnerability scanning and configuration compliance concepts (STIGs, SCAP).
• Experience with at least one scanning tool (Nessus/ACAS, Nmap, STIG Viewer).
• Strong documentation of findings and communication skills.
• Proficiency with MS Office and collaboration tools (Teams).
• CompTIA Security+ or CySA+ certification preferred; RSA Archer experience.

Responsibilities

• Execute security control test procedures against NIST, CNSSI, and IC standards.
• Conduct vulnerability and configuration testing against STIGs and CIS benchmarks.
• Document control weaknesses and deficiencies for Security Assessment Reports.
• Review POA&M entries for accuracy and completeness.
• Perform QA reviews of SSPs, Security Assessment Plans, and POA&Ms.
• Assist in preparing A&A packages in the GRC tool.
• Support System Security Test Reports and portfolio status reporting.

Skills

RMF security testing

NIST SP 800-53A

CNSSI 1253

Vulnerability scanning

SCAP concepts

Nessus/ACAS

Nmap

STIG Viewer

Documentation of findings

GRC tooling (RSA Archer)

A&A package preparation

Security reporting

MS Office (Teams etc)

Clear communication

Top Secret clearance

Education

BS degree in IT/Cybersecurity/Information Systems/CS

Tools

Nessus

ACAS

SCAP

Nmap

STIG Viewer

RSA Archer

Job description

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise. In support of this mission, we have an immediate opportunity for a Junior Security Control Assessor.

In this role you will support assessment and authorization (A&A) of classified and unclassified information systems, executing security control test procedures under the direction of senior assessors. You will run vulnerability and configuration scans, document findings, and help assemble authorization packages. This position is on-site in a Government SCIF in Washington, DC.

• Execute security control test procedures against NIST, CNSSI, and IC standards.
• Conduct vulnerability and configuration testing against DISA STIGs and CIS Benchmarks.
• Document control weaknesses and deficiencies for Security Assessment Reports.
• Review POA&M entries for accuracy and completeness.
• Perform quality assurance reviews of SSPs, Security Assessment Plans, and POA&Ms.
• Assist in preparing A&A packages in the GRC tool.
• Support System Security Test Reports and portfolio status reporting.

Requirements:

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 4 years' experience in IT or cybersecurity.
• Minimum of 1 year of experience in RMF security testing or assessment.
• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• Knowledge of the Risk Management Framework (RMF) and NIST SP 800-53A assessment procedures.
• Knowledge of CNSSI 1253 security control baselines.
• Knowledge of vulnerability scanning and configuration compliance concepts (e.g., STIGs, SCAP).
• Skill in using at least one scanning tool (e.g., Nessus/ACAS, SCAP Compliance Checker, Nmap, STIG Viewer).
• Ability to document findings clearly and accurately.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.
• CompTIA Security+ or CySA+ certification.
• Experience with RSA Archer or a similar GRC tool.