Security Assessor/Analyst Lead

Guidehouse; Arlington (VA); On-site; USD 130,000 - 170,000; Full time

Benefits offered by this job

Medical, Rx, Dental & Vision Insurance

401(k) Retirement Plan

Paid Holidays

Job summary

Guidehouse in Arlington, VA seeks a Security Assessment Lead to head security and privacy control assessments for public-sector and regulated environments, providing technical leadership and oversight of assessment teams. You will evaluate control effectiveness, validate evidence, and advise clients on risks and remediation, while guiding the creation of high-quality assessment documentation.

You will oversee SSPs, SARs, ISRAs, and POA&Ms, ensuring clear communication of findings to technical

Qualifications

• Minimum of five years of professional experience.
• Experience in cybersecurity, information security, technology risk, audit, security control assessment, authorization, or related disciplines.
• Minimum of three years of supervisory or team leadership experience overseeing security assessor teams or security assessment-related personnel.
• US Citizenship is contractually required.
• Demonstrated experience leading or performing security control assessments, audits, risk assessments, or authorization activities.
• Hands-on experience developing and/or reviewing formal security assessment documentation, including SSPs, SARs, POA&Ms, ISRAs, or equivalent artifacts.
• Strong written and verbal communication skills.

Responsibilities

• Lead security and privacy control assessments in accordance with established assessment plans, applicable standards, and client requirements.
• Supervise and provide day-to-day direction to teams of security assessors, including assignment of assessment activities, review of work products, quality assurance, coaching, and professional development.
• Lead assessment planning, execution, documentation, and reporting activities across multiple systems, workstreams, or client stakeholders.
• Review security documentation and technical evidence to evaluate the design, implementation, and operating effectiveness of security and privacy controls.
• Lead and participate in control validation activities, including: Evidence inspection and analysis, Architecture and system documentation review, Interviews and working sessions with system owners, security personnel, and technical stakeholders, Evaluation of technical configurations and other implementation evidence, as applicable.
• Lead the development and quality review of assessment artifacts, including: System Security Plans (SSPs), Security Assessment Reports (SARs), Independent Security Risk Assessments (ISRAs), Plans of Action and Milestones (POAMs), Other risk, compliance, and authorization documentation.
• Clearly articulate control deficiencies, security risks, root causes, and potential remediation considerations to both technical and executive audiences.
• Maintain appropriate assessment independence, objectivity, and professional judgment.
• Serve as a trusted advisor to client stakeholders by helping them understand assessment results, risk implications, and opportunities to strengthen security and privacy controls.
• Establish and promote consistent assessment methodologies, templates, quality standards, and leading practices across assessment teams.
• Identify opportunities to improve assessment efficiency and quality through standardization, tooling, automation, and enhanced evidence collection and validation techniques.
• Support the application of data analytics, AI-assisted techniques, and automation to improve assessment analysis, evidence traceability, reporting, and continuous monitoring.
• Mentor and develop junior and mid-level security professionals and contribute to broader cybersecurity capability development and knowledge sharing.

Skills

Security assessment leadership

Team supervision

Client communication

Risk assessment

Education

Bachelor's Degree

Tools

NIST SP 800-53

Job description

What You Will Do

The Security Assessment Lead will lead and support security and privacy control assessments for public‑sector and regulated environments, providing technical leadership, quality oversight, and day‑to‑day supervision of assessment teams. The role will evaluate the effectiveness of security and privacy controls, validate technical and procedural evidence, advise clients on identified risks and remediation considerations, and oversee the development of high‑quality assessment documentation.

Job Family

Technology Consulting

Travel Required

Up to 10%

Clearance Required

None

Key Job Responsibilities Include The Following

• Lead security and privacy control assessments in accordance with established assessment plans, applicable standards, and client requirements.


• Supervise and provide day‑to‑day direction to teams of security assessors, including assignment of assessment activities, review of work products, quality assurance, coaching, and professional development.


• Lead assessment planning, execution, documentation, and reporting activities across multiple systems, workstreams, or client stakeholders.


• Review security documentation and technical evidence to evaluate the design, implementation, and operating effectiveness of security and privacy controls.


• Lead and participate in control validation activities, including: Evidence inspection and analysis, Architecture and system documentation review, Interviews and working sessions with system owners, security personnel, and technical stakeholders, Evaluation of technical configurations and other implementation evidence, as applicable.


• Lead the development and quality review of assessment artifacts, including: System Security Plans (SSPs), Security Assessment Reports (SARs), Independent Security Risk Assessments (ISRAs), Plans of Action and Milestones (POA&Ms), Other risk, compliance, and authorization documentation.


• Clearly articulate control deficiencies, security risks, root causes, and potential remediation considerations to both technical and executive audiences.


• Maintain appropriate assessment independence, objectivity, and professional judgment.


• Serve as a trusted advisor to client stakeholders by helping them understand assessment results, risk implications, and opportunities to strengthen security and privacy controls.


• Establish and promote consistent assessment methodologies, templates, quality standards, and leading practices across assessment teams.


• Identify opportunities to improve assessment efficiency and quality through standardization, tooling, automation, and enhanced evidence collection and validation techniques.


• Support the application of data analytics, AI‑assisted techniques, and automation to improve assessment analysis, evidence traceability, reporting, and continuous monitoring.


• Mentor and develop junior and mid‑level security professionals and contribute to broader cybersecurity capability development and knowledge sharing.

What You Will Need

• Minimum of FIVE (5) years of professional experience.


• Experience in cybersecurity, information security, technology risk, audit, security control assessment, authorization, or related disciplines.


• Minimum of THREE (3) years of supervisory or team leadership experience overseeing security assessor teams or security assessment‑related personnel.


• Bachelor's Degree from an accredited university.


• US Citizenship is contractually required.


• Demonstrated experience leading or performing security control assessments, audits, risk assessments, or authorization activities.


• Hands‑on experience developing and/or reviewing formal security assessment documentation, including SSPs, SARs, POA&Ms, ISRAs, or equivalent artifacts.


• Strong working knowledge of NIST SP 800‑53 security and privacy controls and risk‑based assessment concepts.


• Experience evaluating technical and procedural evidence to determine control effectiveness and identify security or compliance gaps.


• Experience leading interviews, assessment discussions, and working sessions with technical personnel, system owners, security teams, and other client stakeholders.


• Ability to translate complex technical and security issues into clear, concise, and defensible findings and recommendations.


• Demonstrated experience reviewing the work of other assessors and maintaining quality and consistency across assessment deliverables.


• Strong written and verbal communication skills, including the ability to communicate effectively with technical and senior client stakeholders.


• Ability to manage multiple assessment activities, priorities, and deliverables in a client‑service environment.

What Would Be Nice To Have

• Experience supporting federal, state, local, healthcare, or other highly regulated environments.


• Experience with CMS, healthcare, or public‑sector security and privacy compliance frameworks.


• Deep familiarity with Assessment & Authorization (A&A), Risk Management Framework (RMF), Security Control Assessment (SCA), or similar risk and compliance processes.


• Relevant professional certifications such as CISA, CISSP, CISM, CRISC, Security+, CAP/CGRC, or similar.


• Experience with security engineering, cloud security, identity and access management (IAM), logging/monitoring, vulnerability management, or system implementation.


• Familiarity with modern technology architectures, including cloud platforms, IAM solutions, APIs, security monitoring platforms, and how security controls are implemented and assessed within these environments.


• Experience with automation, scripting, data analytics, or Governance, Risk, and Compliance (GRC) platforms supporting assessment or compliance activities.


• Experience applying AI, automation, or data‑driven techniques to improve audit readiness, evidence analysis, compliance monitoring, assessment execution, or reporting.


• Experience supporting business development, growth, capture, proposal development, or client account expansion within cybersecurity, technology risk, or related consulting services.


• Experience identifying emerging client needs and helping develop new cybersecurity services, methodologies, accelerators, intellectual property, or other firm capabilities.


• Experience contributing to proposal development, solutioning, oral presentations, demonstrations, marketing materials, white papers, or other go‑to‑market activities.


• Experience building relationships with clients, industry partners, technology vendors, or other ecosystem organizations to support growth and capability development.


• Interest in helping grow and differentiate a cybersecurity assessment practice through thought leadership, innovation, market awareness, and development of repeatable service offerings.

What We Offer

Guidehouse offers a comprehensive, total rewards package that includes competitive compensation and a flexible benefits package that reflects our commitment to creating a diverse and supportive workplace.

Benefits Include

• Medical, Rx, Dental & Vision Insurance


• Personal and Family Sick Time & Company Paid Holidays


• Position may be eligible for a discretionary variable incentive bonus


• Parental Leave and Adoption Assistance


• 401(k) Retirement Plan


• Basic Life & Supplemental Life


• Health Savings Account, Dental/Vision & Dependent Care Flexible Spending Accounts


• Short-Term & Long-Term Disability


• Student Loan PayDown


• Tuition Reimbursement, Personal Development & Learning Opportunities


• Skills Development & Certifications


• Employee Referral Program


• Corporate Sponsored Events & Community Outreach


• Emergency Back‑Up Childcare Program


• Mobility Stipend

About Guidehouse

Guidehouse is an Equal Opportunity Employer–Protected Veterans, Individuals with Disabilities or any other basis protected by law, ordinance, or regulation.

Guidehouse will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of applicable law or ordinance including the Fair Chance Ordinance of Los Angeles and San Francisco.

If you have visited our website for information about employment opportunities, or to apply for a position, and you require an accommodation, please contact Guidehouse Recruiting at 1‑571‑633‑1711 or via email at [e-mail].

All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodation.

All communication regarding recruitment for a Guidehouse position will be sent from Guidehouse email domains including @guidehouse.com or [e-mail]. Correspondence received by an applicant from any other domain should be considered unauthorized and will not be honored by Guidehouse.

Guidehouse does not accept unsolicited resumes through or from search firms or staffing agencies. All unsolicited resumes will be considered the property of Guidehouse and Guidehouse will not be obligated to pay a placement fee.