Security Control Assessor: A&A & FISMA Lead

National Institute of Standards and Technology (NIST); Gaithersburg (MD); On-site; USD 85,000 - 110,000; Full time

Job summary

National Institute of Standards and Technology (NIST) is seeking a Security Control Assessor to lead A&A activities and ensure FISMA compliance. The role requires conducting security assessments, reviewing documentation, and documenting risks and plans of action and milestones for IT security across the agency.

The ideal candidate will hold an active IT security certification and have at least one year of specialized experience at the GS-12 level, with strong knowledge of security controls and

Qualifications

• Selective Placement Factor: Applicants must possess a current/active IT Security Certification (e.g., CISSP, GIA, SSCP, CEH, GCIH, CISA, CGRC).
• Specialized Experience: One year (52 weeks) of specialized experience equivalent to at least GS-12 (ZP-III at NIST).
• Specialized experience includes: detailed security assessments against SP 800-53 Rev 5 controls; developing SSPs, Risk Assessments, Security Categorization, Privacy Impact Assessments, Test & Evaluation, and Contingency Plans; reviewing security authorization packages.

Responsibilities

• Conduct A&A activities on NIST systems per FISMA requirements; review security documentation to ensure proper control implementation; perform security assessments against required controls; document risks and POA&Ms for mitigations.

Job description

National Institute of Standards and Technology (NIST) is seeking a Security Control Assessor to lead A&A activities and ensure FISMA compliance. The role requires conducting security assessments, reviewing documentation, and documenting risks and plans of action and milestones for IT security across the agency.

The ideal candidate will hold an active IT security certification and have at least one year of specialized experience at the GS-12 level, with strong knowledge of security controls and