Security Control Assessor

Steampunk; Bloomington (IL); On-site; USD 105,000 - 160,000; Full time

Job summary

Steampunk is seeking a Security Control Assessor to support a government customer, ensuring risk remains at an acceptable level. The role requires initiative, organization, and strong communication across all levels, with handling of sensitive information in a fast-paced environment.

Responsibilities include leading assessments, evaluating controls across environments, developing Assessment Plans and SARs, coordinating with ISSOs and officials, analyzing vulnerabilities, presenting findings, and

Qualifications

• College degree plus experience in federal cybersecurity.
• Experience with NIST RMF and FedRAMP is required.
• Ability to review security artifacts and provide independent evaluations.

Responsibilities

• Lead security assessments per NIST SP 800-53 and RMF.
• Evaluate controls across cloud, on-prem, and hybrid environments.
• Develop Assessment Plans and SARs compliant with standards.
• Coordinate with ISSOs, System Owners, and Authorization Officials.
• Analyze vulnerability scans and remediation activities.
• Present findings to management and Authorization Officials.
• Support continuous monitoring and ongoing authorization.

Skills

NIST knowledge

Security assessment

Vulnerability analysis

Cloud/on-prem

Education

Bachelor's degree

Master's degree

Tools

Nessus

Tenable.SC

Splunk

SCAP scanners

IAM/MFA tooling

Job description

Overview

Steampunk is seeking a Security Control Assessor to support a government customer, ensuring risk within the system is maintained at an acceptable level. This role requires initiative, organization, strong communication across all levels of the organization, and sound judgment with sensitive and confidential information in a fast-paced environment.

Contributions

As a member of one of ourassessmentteams, you will playan importantroleinperforming a wide array ofcybersecurity duties include:

• Lead security assessments in accordance with NIST SP 800-53, NIST RMF (SP 800-37), FedRAMP, and agency-specific guidance.
• Evaluate technical, operational, and management controls across cloud, on-premises, and hybrid environments, including hands-on review of technical control evidence (e.g., encryption configurations, SIEM logging, identity/access management, network boundary controls, STIG compliance).
• Develop Assessment Plans and Security Assessment Reports (SARs), and document findings and risk in compliance with FISMA, FedRAMP, and organizational standards.
• Coordinate with ISSOs, System Owners, and Authorization Officials to review evidence and remediate control deficiencies.
• Analyze vulnerability scans, configuration baselines, and penetration test results to determine control effectiveness and recommend remediation.
• Present findings and risk analysis to management and Authorization Officials.
• Support continuous monitoring and control validation for ongoing authorization.

Qualifications

• Bachelor's Degree and 5 years of relevant experience; OR
  • No degree with a total of 9 years of relevant experience; OR
  • Master's degree and 3 years of relevant experience
• One of the following certifications (may be obtained within six (6) months of hire):
  • Certified Information System Security Professional (CISSP)
  • CompTIA Advanced Security Practitioner (CASP)
  • Certified Information Systems Auditor (CISA)
  • Certified Information Security Manager (CISM)
• Strong knowledge of NIST SP 800-53, FIPS 199/200, and NIST SP 800-30/37/39/53/60; familiarity with DHS Directive 4300A.
• Hands-on experience reviewing security control artifacts and providing independent evaluations for system authorization packages, including in cloud environments (AWS, Azure).
• Proficiency with assessment/scanning tools (e.g., Nessus, Tenable.SC, Splunk, SCAP scanners) and analytical skill to interpret vulnerabilities and compliance gaps.
• Demonstrated ability to review technical controls directly, as a core part of the role — for example: verifying FIPS-validated encryption, auditing SIEM logging architecture, reviewing IAM/MFA enforcement (AD, Okta, Azure AD), analyzing firewall/ACL/Security Group configurations, and evaluating DISA STIG results.

Preferred:

• Experience as a Security Control Assessor and performing risk analysis/assessment.
• Working knowledge of AWS/Azure GovCloud and enterprise application stacks (e.g., Maven, Jenkins, Ansible, Tomcat, IIS, F5, Oracle, MSSQL, PostgreSQL).
• Familiarity with AI/ML concepts and their security implications.
• Working knowledge of JIRA, ServiceNow, or equivalent.

About steampunk

Steampunk relies on several factors to determine salary, including but not limited to geographic location, contractual requirements, education, knowledge, skills, competencies, and experience. The projected compensation range for this position is $105,000 to $160,000. The estimate displayed represents a typical annual salary range for this position. Annual salary is just one aspect of Steampunk’s total compensation package for employees. Learn more about additional Steampunk benefits here.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Steampunk is a Change Agent in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our Human-Centered delivery methodology, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges.If you want to learn more about our story, visit http://www.steampunk.com.

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law.Steampunk participates in the E-Verify program.