RMF Security Control Assessor – TS/SCI, ATO/ATC

ANALYGENCE; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

Tharros is seeking a Security Control Assessor to lead independent security control assessments for DHS Intelligence Enterprise systems, both on-premise and cloud. The role covers discovery through ATO/ATC/IATT packages, with responsibility for writing Security Assessment Reports and validating remediation.

You will collaborate with system owners and ISSOs, document evidence of compliance, and prepare A&A artifacts in the GRC tool. The position is on-site in a Government SCIF in Washington, DC.

Qualifications

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 6 years' experience in IT or cybersecurity.
• 3+ years' experience in RMF security control assessment.
• Active TS/SCI clearance and U.S. citizenship; willing to undergo DHS polygraph.

Responsibilities

• Conduct discovery and kick-off meetings with project stakeholders for new and re-authorization activities.
• Assess management, operational, and technical security controls against RMF, NIST, CNSS and IC standards.
• Conduct vulnerability, configuration, container, and serverless testing across on-premise and cloud environments.
• Document findings in Security Assessment Reports and ensure alignment with POA&Ms.
• Validate POA&Ms remediation and document evidence of compliance.
• Prepare A&A packages in the GRC tool, including risk memoranda and ATO/ATC/IATT letters.
• Produce System Security Test Reports and A&A portfolio reports.
• Provide recommendations to mitigate risk and improve the security posture of assigned systems.

Skills

RMF knowledge

NIST SP 800-53A

CNSSI knowledge

Security assessment writing

Independent coordination

Excellent communication

Education

BS degree in IT/Cybersecurity/IS/CS

Tools

Nessus/ACAS

SCAP

Nmap

WebInspect

SonarQube

STIG Viewer

Job description

Tharros is seeking a Security Control Assessor to lead independent security control assessments for DHS Intelligence Enterprise systems, both on-premise and cloud. The role covers discovery through ATO/ATC/IATT packages, with responsibility for writing Security Assessment Reports and validating remediation.

You will collaborate with system owners and ISSOs, document evidence of compliance, and prepare A&A artifacts in the GRC tool. The position is on-site in a Government SCIF in Washington, DC.