Security Control Assessor

Evolver Federal; Washington (District of Columbia); On-site; USD 110,000 - 170,000; Full time

Job summary

Evolver is seeking a Security Control Assessor to support a federal client in Washington, DC. The role requires on-site work five days a week at the client’s HQ in DC, performing independent security control testing for 20 FIPS Moderate and Low systems.

Responsibilities include developing assessment plans, reviewing artifacts, and presenting results to government stakeholders such as System Owners, ISSOs, and the CISO, with focus on risk-based recommendations and POA&M tracking.

Qualifications

• Bachelor's degree in computer science, Information Technology, or a related field.
• 4 years of experience in conducting security testing in accordance with NIST SP 800-53A.
• 4 years of experience creating POA&Ms in the CSAM tool.
• 2 years of experience with NIST SP 800-53-A and security control assessment methodologies.
• 2 years of experience with security program management, including policy and procedure development, Continuous Monitoring, and risk management.
• US Citizen with the ability to pass a comprehensive background check.
• 2 years of previous client-engagement experience.

Responsibilities

• Conduct security testing in accordance with NIST SP 800-53-A.
• Develop Security Controls Assessment Plans, including interviewing, examining, and/or testing management, operational, and technical controls.
• Gather evidence for tested controls.
• Summarize testing results and highlight high/moderate risk items and compliance percentages.
• Document results within the Security Controls Assessment Plan.
• Analyze and summarize scan results, using cloud environment scans.
• Assist in updating the client's IT Security Program policies and procedures.
• Provide timely reminders to Agency ISSOs to support Continuous Monitoring.
• Assist in launching the Configuration Management program with DISA STIG guidance.
• Produce Security Assessment Reports (SAR) using the Agency's IA tool.
• Evaluate risk of SAR findings and summarize into POA&M tracking.
• Track IT Risk Management progress via POA&M updates and data submission.
• Review artifacts, evaluate remediation, and recommend POA&M closure.

Skills

Security testing

NIST SP 800-53A

POA&M

CSAM tool

Client engagement

Background check

Education

Bachelor's degree in computer science, Information Technology, or related field

Tools

CSAM tool

Security scanning tools

Microsoft Office

Job description

Evolver is an information technology, cybersecurity, and digital transformation company supporting national defense, federal civilian agencies, and Fortune 500 organizations. We help customers secure critical systems, modernize enterprise technology, and solve complex operational challenges through integrated technology capabilities spanning cybersecurity, enterprise IT infrastructure, cloud, software development, data analytics, legal technology and eDiscovery, applied AI, and electronic security systems. Our teams combine deep technical expertise with mission understanding to deliver secure, reliable, and scalable solutions that advance performance in high-stakes environments.

Evolver is looking for a Security Control Assessor to join our team supporting our federal client in Washington, DC. This position requires on-site 5 days/week at our federal client's HQ located in Washington, DC.

The Security Control Assessor is responsible for providing independent security control testing to the client for 20 FIPS Moderate and Low systems. Duties include conducting security control assessments through interviews, examination, and/or testing for all applicable management, operational, and technical controls, including analyzing findings and results and validating test results/ reports. Duties also include developing Security Control Assessment Plans, Risk Assessment Reports, and ATO Memos, as well as developing and maintaining testing policies and related Standard Operating Procedures (SOPs). The Security Control Assessor is also responsible for documenting and presenting the results of the Security Test & Evaluation (ST&E) to government stakeholders including System Owners, ISSOs, the CISO and Authorizing Official. Responsibilities also include reviewing artifacts and providing recommendations on POA&M closures.

Responsibilities

• Conduct security testing in accordance with NIST SP 800-53-A.
• Develop Security Controls Assessment Plans, including:
  • Interviewing, examining, and/or testing management, operational, and technical controls.
  • Gathering evidence for tested controls.
  • Summarizing testing results, highlighting high/moderate risk items and compliance percentages.
  • Documenting results within the Security Controls Assessment Plan.
  • Analyzing and summarizing scan results, utilizing scans provided by the cloud environment.
• Assist in updating the client's IT Security Program policies and procedures.
• Provide timely reminders to Agency ISSOs to support Continuous Monitoring efforts.
• Assist in launching the client's Configuration Management program, including compliance testing and guidance on implementing DISA's Security Technical Implementation Guides (STIGs).
• Produce Security Assessment Reports (SAR) using the Agency's Information Assurance tool.
• Evaluate the risk of SAR findings from security testing and summarize them into Plan of Action and Milestone (POA&M) tracking documentation.
• Track the progress of the IT Risk Management program through POA&M updates and/or data submission to the Agency's Office of Risk Management.
• Review supporting artifacts, evaluate remediation of risk, and recommend POA&M closure

Basic Qualifications

• Bachelor's degree in computer science, Information Technology, or a related field.
• 4 years of experience in conducting security testing in accordance with NIST SP 800-53A.
• 4 years of experience creating POA&Ms in the CSAM tool.
• 2 years of experience with NIST SP 800-53-A and security control assessment methodologies.
• 2 years of experience with security program management, including policy and procedure development, Continuous Monitoring, and risk management.
• US Citizen with the ability to pass a comprehensive background check.
• 2 years of previous client-engagement experience.

Preferred Qualifications

• Strong analytical skills and ability to quantify and analyze test findings.
• Knowledge of security tools and techniques, including scanning tools.
• Understanding of cloud environments and related security implications.
• Excellent communication (verbal and written) and collaboration skills, with the ability to work effectively with security staff and Agency ISSOs.
• Impeccable work ethic, the ability to make sound decisions, and a commitment to integrity and accountability.
• Excellent organizational skills and attention to detail.
• Strong analytical, critical thinking, and problem-solving skills.
• Ability to function well in a high-paced and at times stressful environment.
• Ability to prioritize tasks.
• Proficient with Microsoft Office Suite; specifically, Excel, Word, and Outlook a must.
• One or more of the following certifications preferred: CISSP, CAP, CISM, Security+, CASP, CISA.

Evolver is an equal opportunity employer and welcomes all job seekers. It is the policy of Evolver not to discriminate based on race, color, ancestry, religion, gender, age, national origin, gender identity or expression, sexual orientation, genetic factors, pregnancy, physical or mental disability, military/veteran status, or any other factor protected by law.

Actual salary will depend on factors such as skills, qualifications, experience, market and work location. Evolver offers competitive benefits, including health, dental and vision insurance, 401(k), flexible spending account, and paid leave (including PTO and parental leave) in accordance with our applicable plans and policies.