Security Controls Assessor - Senior

Cherokee Federal

United States

On-site

USD 120,000 - 180,000

Full time

14 days+

Application generator

Don’t send a generic resume — generate a resume and cover letter tailored to this exact role.

Get past ATS filters

Benefits offered by this job

Medical

Dental

Vision

401K

Job summary

A leading federal contracting company is seeking a Senior Security Controls Assessor to conduct independent assessments of MARAD information systems. You will provide assessments in line with NIST standards, work collaboratively with various stakeholders, and ensure cyber security compliance. This role demands extensive experience in maritime cyber security, coupled with a Bachelor's in Cybersecurity or a related field. The position offers competitive benefits and opportunities for professional development.

Qualifications

12 years of related work experience is required.
Possess or be able to obtain a Public Trust clearance.
Prior US Navy or Coast Guard experience is essential.

Responsibilities

Conduct independent assessments of MARAD information systems.
Develop security assessment plans and reports in compliance with NIST standards.
Collaborate with various stakeholders for compliance and risk mitigation.
Review core documentation to support SAP, SOB, and ATO milestones.
Identify non-compliance issues and propose mitigations.
Validate that systems meet stated security requirements and assess overall control effectiveness.
Develop SAP, SAR, and RAR in line with NIST SP 800-53A/800-37.

Skills

Cybersecurity

Maritime Cyber Security

Security Assessment

Risk Management

NIST Compliance

Education

Bachelor's Degree in Cybersecurity or related IT field

IT Related Field

Tools

NIST Special Publication 800-53A

NIST SP 800-30

Job description

Security Controls Assessor - Senior

This position requires an active Public Trust clearance or the ability to obtain a Public Trust clearance to be considered.

Applicant MUST have prior US Navy or Coastguard Maritime Cyber Security experience.

The Senior Security Controls Assessor provides independent assessments of MARAD information systems in support of system authorization, reauthorization, and continuous monitoring activities. This role evaluates management, operational, and technical security controls in accordance with NIST Risk Management Framework (RMF) requirements, supports Authority to Operate (ATO) decisions, develops assessment documentation and reports, and collaborates with MARAD, DOT, and cybersecurity stakeholders to ensure compliance, risk visibility, and mission assurance.

Compensation & Benefits

Pay commensurate with experience.

Full time benefits include Medical, Dental, Vision, 401K, and other possible benefits as provided. Benefits are subject to change with or without notice.

Responsibilities

Assess MARAD systems in one of three states: System Authorization: Initial Authorization, Reauthorization, or Continuous Monitoring Assessment (CMA), also known as ongoing authorization. The Independent Assessor must be prepared to support the process within each of these three Authorization states.
Provide annual assessment support to the NSMV and MARAD CIO programs. NSMV assessment support will involve conducting on-site evaluations at the Philadelphia shipyard and other locations.
Conduct independent assessments of specified MARAD information systems following the System Authorization process as defined in the current DOT Security Authorization and Continuous Monitoring Performance Guide and associated templates.
Review existing information system core documentation including privacy requirements data to support development of security assessment plans and schedules support authority to operate (ATO) dates. Review and establish Annual Assessment schedule in support of deliverables and artifacts.
Provides identification of non-compliance of security requirements and possible mitigations to requirements that are not in compliance
Validates the security requirements of the information system
Verifies and validates that the system meets the security requirements
Conduct independent, comprehensive assessments of management, operational, and technical security controls and control enhancements within IT systems to determine overall effectiveness.
Execute and conduct analysis of network and systems to validate appropriate security control implementation. Documentation
Develop security assessment plans and assessment reports compliant with latest revisions of NIST Special Publication 800-53A Recommended Security Controls for Federal Information Systems and Organizations and NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems.
Develop Security Assessment Plan (SAP) detailing assessment scope with clarity, specifying scope exclusions, if necessary, controls being assessed, methods of performing assessment including sampling and “determine if” statements, notional schedule, assessment staff members, inventory of targeted system endpoints/components and software, processes, status of account of system specific, hybrid and inherited controls.
The Assessor must adhere to the approved SAP while executing security controls assessment against targeted information system(s). Use approved techniques to collect and catalogue evidence of security controls assessment findings i.e. documents, screen captures, scanning report(s), interview session notes to support claims of control implementation status (in – place or other).
Develop security assessment report (SAR) in accordance with scope and schedule defined in the SAP. SAR must detail assessment findings of controls assessed with supporting evidence substantiating claims.
Develop / update system qualitative risk assessment reports (RAR) compliant with NIST SP 800-30 Guide for Conducting Risk Assessments.
Develop recommendation report aiding in Plan of Action and Milestone (POA&M) development. Recommendation report would detail findings and applicable actions and effort to be considered for remediation.
Develop security assessment executive summary documents including summative presentation further providing an overview of activities, findings, risks and mitigation recommendations.
Enter assessment data the Cyber Security Assessment and Management (CSAM) database, the ATO system of record used by DOT.
Provide presentations, reports, evaluations, reviews, meeting minutes and working papers in support of all tasks as requested by the COR.
Apply MARAD/DOT A&A guidance and policy to achieve the program objectives and enhancing the overall quality of packages for receiving an ATO Stakeholder Collaboration and Guidance
Actively work with the designated Information Systems Security Manager ISSM
Performs other job-related duties as assigned

Experience, Education, Skills, Abilities requested

Bachelor's Degree in Cybersecurity or related IT field may be substituted for 4 years of experience
Bachelors Degree in an IT Related Field.
Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), or equivalent certification
12 years of related work experience
Prior experience supporting US Navy or Coast Guard Maritime Cyber Assessments
Clearance: Must possess or be able to obtain a public Trust.
Prior Department of Transportation experience is a plus.
Must pass pre-employment qualifications of Cherokee Federal