RMF Cyber Security Controls Assessor

CACI International Inc.; Washington, Northern (District of Columbia, KY); Hybrid; USD 87,000 - 182,000; Full time

Job summary

CACI International Inc. is seeking a Cyber Security Control Assessor to support FEMA's OCISO in Washington, D.C. You will perform independent assessments of security controls across systems, evaluating design, implementation, and effectiveness under RMF and NIST SP 800-53.

You will conduct interviews, document findings, develop SAPs, RTMs, SARs, and contribute to authorization to operate with a focus on risk reduction and continuous monitoring.

Qualifications

• BS/BA plus 6 years of RMF, control assessment, audit, cybersecurity compliance, or security engineering experience.
• Strong knowledge of NIST SP 800-53 and RMF (NIST SP 800-37).
• Experience with security control assessment methodologies and tools.
• Experience generating Security Assessment artifacts (SAPs, RTMs, SARs).
• Ability to review SSPs, policies, procedures, and evidence artifacts to identify gaps and residual risk.

Responsibilities

• Evaluate the effectiveness of IT security controls and determine compliance with NIST RMF and DHS requirements.
• Analyze SSPs, policies, procedures, and evidence artifacts for completeness and accuracy.
• Identify security gaps and evaluate residual risk; generate findings for assessment reports.
• Develop and document POA&Ms and support risk mitigation planning.
• Support authorization to operate and continuous monitoring activities across assigned systems.

Skills

RMF knowledge

NIST SP 800-53

NIST SP 800-37 RMF

Security control assessment

Vulnerability assessment

Technical writing

POA&M development

Education

BS/BA + 6 years experience

Tools

Tenable

Qualys

STIG Viewer

CSAM

eMASS

Job description

CACI International Inc. is seeking a Cyber Security Control Assessor to support FEMA's OCISO in Washington, D.C. You will perform independent assessments of security controls across systems, evaluating design, implementation, and effectiveness under RMF and NIST SP 800-53.

You will conduct interviews, document findings, develop SAPs, RTMs, SARs, and contribute to authorization to operate with a focus on risk reduction and continuous monitoring.