Security Assessor

Method, Inc.; Washington (District of Columbia); On-site; USD 110,000 - 150,000; Full time

Job summary

Spry Methods seeks a Security Assessor in DC to join our team and perform comprehensive risk-based security assessments. The role emphasizes RMF processes, SA&A activities, and testing across networks, systems, and applications in cloud environments.

The candidate should bring 5+ years of security assessment experience, expertise in MS Azure and AWS, and the ability to translate risk into actionable mitigation plans for customers.

Qualifications

• Requires at least 5 years of relevant security assessment experience.
• Bachelor's Degree or 4 years of specialized experience are acceptable.
• Strong background in security assessor roles and RMF knowledge.

Responsibilities

• Maintain strong working knowledge of IT security requirements and risk management processes.
• Conduct full cycle Security Assessment & Authorization (SA&A).
• Test network, system, and application security controls per NIST RMF.
• Analyze vulnerability scans and interpret risks; validate data with manual checks.
• Assist customers in understanding risk and providing mitigation steps.
• Create Security Assessment Plans, Reports, and Plan of Actions & Milestones (POA&Ms).
• Interview personnel, review documentation, and verify control evidence.

Skills

RMF knowledge

Risk assessment

Vulnerability analysis

SA&A (Security Assessments)

Cloud security

NIST controls testing

Education

Bachelor's degree or equivalent

Tools

MS Azure

AWS

Job description

Who We’re Looking For (Position Overview):

Spry Methods is on the search for a Security Assessor to join our team in DC.

What Your Day-To-Day Looks Like (Position Responsibilities):

• Strong working knowledge of IT Security requirements, technical security countermeasures, risk managements processes, contingency planning, and secure data communications
• Demonstrated experience conducting full cycle SA&A
• Testing will include network, system, applicationand NIST control testing from administrative and technical perspectives
• Experience analyzing vulnerability scans and interpreting risks and employing manual checks to validate vulnerability data
• Be able to assist the customer withunderstanding risk and providing risk mitigation
• Will create Security Assessments Plans, Reports, and POA&Ms
• The securityassessment team conducts documentation reviews, inspections, and interviews with key personnel knowledgeable/ responsible for the various controls
• Personnel interviewed are asked to showevidence of compliance,demonstration security features, provide access to (or screenshotsof) configuration files and system logs, and perform tests
• Thedetermination of compliance will be based upon responses to questions and analysis ofsupporting evidence..
• Knowledge of CSAMis a plus
• Strong cloud experience - conducting security assessments of MS Azure in AWS environments.

What You Need to Succeed (Minimum Requirements):

• At least 5 years experience
• Bachelor's Degree or 4 years of specialized experience
• Strong security assessor background
• Must understand the Risk Management Framework (RMF) process