Security Control Assessor

tharros; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Job summary

Tharros is seeking a Security Control Assessor to lead independent RMF security control assessments for DHS Intelligence Enterprise systems, both on-premises and in the cloud. This on-site role in a Government SCIF in Washington, DC, involves crafting assessment reports, validating remediation, and coordinating with system owners and ISSOs.

You will drive discovery, perform testing against RMF/NIST/CNSSI standards, and prepare A&A packages with risk memos.

Qualifications

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 6 years' experience in IT or cybersecurity.
• Minimum of 3 years' experience in RMF security control assessment.
• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• Knowledge of RMF, NIST SP 800-53A, and CNSSI 1253.
• Knowledge of the ATO, ATC, and IATT authorization process.
• Knowledge of POA&M management and risk acceptance processes.
• Skill in writing Security Assessment Reports and risk recommendations.

Responsibilities

• Conduct discovery and kick-off meetings with project stakeholders for new and re-authorization activities.
• Assess management, operational, and technical security controls against NIST, CNSSI, and IC standards.
• Conduct vulnerability, configuration, container, and serverless testing across on-premise and cloud environments.
• Document findings in Security Assessment Reports and ensure alignment with POA&Ms.
• Validate POA&M remediation and document evidence of compliance.
• Prepare A&A packages in the GRC tool, including risk memoranda and ATO/ATC/IATT letters.
• Produce System Security Test Reports and A&A portfolio reports.
• Provide recommendations to mitigate risk and improve the security posture of assigned systems.

Skills

Leadership

Strong communication

RMF knowledge

Independent leadership

Cloud authorization experience

Education

Bachelor's degree in IT / Cybersecurity / Information Systems / CS

Tools

Nessus/ACAS

SCAP

Nmap

WebInspect

SonarQube

STIG Viewer

MS Office / Teams

Job description

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise. In support of this mission, we have an immediate opportunity for a Security Control Assessor.

In this role you will lead independent security control assessments of DHS Intelligence Enterprise systems, on-premise and in the cloud, from discovery through a completed authorization package supporting ATO, ATC, and IATT decisions. You will write assessment reports, validate remediation, and work closely with system owners and ISSOs. This position is on-site in a Government SCIF in Washington, DC.

• Conduct discovery and kick-off meetings with project stakeholders for new and re-authorization activities.
• Assess management, operational, and technical security controls against NIST, CNSSI, and IC standards.
• Conduct vulnerability, configuration, container, and serverless testing across on-premise and cloud environments.
• Document findings in Security Assessment Reports and ensure alignment with POA&Ms.
• Validate POA&M remediation and document evidence of compliance.
• Prepare A&A packages in the GRC tool, including risk memoranda and ATO/ATC/IATT letters.
• Produce System Security Test Reports and A&A portfolio reports.
• Provide recommendations to mitigate risk and improve the security posture of assigned systems.

Requirements:

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 6 years' experience in IT or cybersecurity.
• Minimum of 3 years' experience in RMF security control assessment.
• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• Knowledge of the Risk Management Framework (RMF), NIST SP 800-53A, and CNSSI 1253.
• Knowledge of the ATO, ATC, and IATT authorization process.
• Knowledge of POA&M management and risk acceptance processes.
• Skill in using at least two security tools (e.g., Nessus/ACAS, SCAP, Nmap, WebInspect, SonarQube, STIG Viewer).
• Skill in writing Security Assessment Reports and risk recommendations.
• Ability to lead an assessment independently and coordinate with system owners.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.
• CGRC (formerly CAP), CompTIA Security+, or CySA+ certification.
• Cloud authorization experience (AWS or Azure).