RMF Security Control Assessor — ATO/ATC Expert

tharros

Washington (District of Columbia)

On-site

USD 120,000 - 170,000

Full time

2 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Tharros is seeking a Security Control Assessor to lead independent RMF security control assessments for DHS Intelligence Enterprise systems, both on-premises and in the cloud. This on-site role in a Government SCIF in Washington, DC, involves crafting assessment reports, validating remediation, and coordinating with system owners and ISSOs.

You will drive discovery, perform testing against RMF/NIST/CNSSI standards, and prepare A&A packages with risk memos.

Qualifications

BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 6 years' experience in IT or cybersecurity.
Minimum of 3 years' experience in RMF security control assessment.
Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
Knowledge of RMF, NIST SP 800-53A, and CNSSI 1253.
Knowledge of the ATO, ATC, and IATT authorization process.
Knowledge of POA&M management and risk acceptance processes.
Skill in writing Security Assessment Reports and risk recommendations.

Responsibilities

Conduct discovery and kick-off meetings with project stakeholders for new and re-authorization activities.
Assess management, operational, and technical security controls against NIST, CNSSI, and IC standards.
Conduct vulnerability, configuration, container, and serverless testing across on-premise and cloud environments.
Document findings in Security Assessment Reports and ensure alignment with POA&Ms.
Validate POA&M remediation and document evidence of compliance.
Prepare A&A packages in the GRC tool, including risk memoranda and ATO/ATC/IATT letters.
Produce System Security Test Reports and A&A portfolio reports.
Provide recommendations to mitigate risk and improve the security posture of assigned systems.