Senior Cloud Security Assessor

Method, Inc.; Washington; Vor Ort; USD 140.000 - 190.000; Vollzeit

Zusammenfassung

Spry Methods seeks a Senior Cloud Security Assessor to lead independent security assessments of cloud and hybrid systems supporting federal missions in the Washington, DC area.

The role requires hands-on experience with SA&A, FedRAMP packages, RMF processes, and strong technical writing to communicate findings to technical teams and executives. Expect rigorous analysis, evidence-driven conclusions, and practical risk mitigation guidance.

Qualifikationen

• Active CISSP certification required.
• Eight+ years conducting security control assessments.
• Experience assessing FedRAMP/federal cloud environments.
• Knowledge of RMF and NIST security control practices.
• Ability to analyze large volumes of evidence and draw conclusions.
• Excellent writing and stakeholder communication.

Aufgaben

• Lead full-cycle SA&A activities for cloud, hybrid, and enterprise systems as an independent assessor.
• Assess Azure and AWS environments, including controls effectiveness.
• Review FedRAMP packages and analyze applicability, gaps, and responsibilities.
• Analyze artifacts like SSPs, policies, architecture diagrams, and logs.
• Develop SAPs, SARs, RARs, Evidence Lists, and POA&Ms.
• Perform security testing from admin, operational, and technical perspectives.
• Interpret vulnerability findings, distinguish true risks from false positives.
• Apply requirements with practical judgment using data context.
• Communicate findings and mitigation options to teams and executives.
• Coordinate evidence requests and assessment schedules with customers.
• Support program operations and quality reviews for defensible reporting.

Kenntnisse

Analytical skills

Technical writing

Stakeholder communication

Independent assessor experience

Security assessments

Ausbildung

CISSP certification

Bachelor's degree in cybersecurity / related field

Eight years of relevant experience

Tools

CSAM or governance platform

Jobbeschreibung

Experienced assessor sought to lead rigorous, evidence-based security assessments of cloud and hybrid systems supporting federal missions.

Who we are looking for:

Spry Methods is seeking an experienced Senior Cloud Security Assessor to join our team in the Washington, DC area. The successful candidate will bring extensive hands-on experience conducting independent security control assessments of cloud and hybrid systems, with particular depth in federal cloud environments. This role requires sound professional judgment, strong analytical skills, and a practical, common-sense approach to applying security requirements to system data, technical evidence, mission context, and actual risk.

Key Responsibilities:

• Lead full-cycle Security Assessment and Authorization (SA&A) activities for cloud, hybrid, and enterprise systems as an independent assessor.
• Assess Microsoft Azure and Amazon Web Services (AWS) environments, including the implementation and operating effectiveness of administrative, operational, and technical security controls.
• Retrieve and review FedRAMP authorization packages and supporting documentation, then analyze the package for applicability, control inheritance, residual risk, gaps, and customer responsibilities.
• Conduct detailed analysis of assessment artifacts, including system security plans, policies, procedures, architecture and data-flow diagrams, inventories, configurations, logs, scan results, test outputs, and other supporting evidence.
• Develop Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), Required Evidence Lists, and Plans of Action and Milestones (POA&Ms).
• Perform network, system, application, and NIST security control testing from administrative, operational, and technical perspectives.
• Analyze vulnerability scan results, interpret risk, and use manual validation and corroborating evidence to distinguish actionable findings from false positives or unsupported conclusions.
• Apply security requirements using practical judgment and data context rather than relying solely on checklist compliance. Evaluate whether evidence is relevant, reliable, sufficient, and representative of the assessed environment.
• Clearly communicate findings, risk, root cause, and feasible mitigation options to technical teams, system owners, executives, and other assessment stakeholders.
• Coordinate evidence requests, interviews, test activities, and assessment schedules with customer personnel and Information Systems Security Analysts.
• Support security assessment program operations and contribute to consistent assessment methods, quality reviews, and defensible reporting.

Minimum Qualifications

• Active Certified Information Systems Security Professional (CISSP) certification is required.
• At least eight years of demonstrated, hands-on experience conducting security control assessments, including substantial experience serving as an independent assessor for cloud and hybrid systems.
• Extensive experience conducting independent security assessments of federal systems hosted in Microsoft Azure and AWS environments, including evaluation of security controls, architecture, inherited controls, customer-configured controls, and cloud-specific risks.
• Demonstrated experience retrieving, navigating, and analyzing FedRAMP authorization packages and associated security artifacts.
• Strong knowledge of federal Risk Management Framework (RMF) processes and NIST security control assessment practices.
• Ability to analyze large volumes of technical and governance evidence, connect information across artifacts, identify inconsistencies, and reach clear, supportable conclusions.
• Strong understanding of IT security requirements, technical countermeasures, vulnerability management, risk management, contingency planning, secure data communications, and system security architecture.
• Excellent technical writing and stakeholder communication skills, with the ability to explain risk and recommended mitigation in clear, decision-oriented language.
• Bachelor's degree in cybersecurity, information technology, computer science, or a related field, or eight additional years of relevant specialized experience.
• Experience using CSAM or a comparable governance, risk, and compliance platform.

Preferred Qualifications

• Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), Certified Governance, Risk and Compliance (CGRC), or comparable cloud or assessment certification.
• Experience supporting federal cybersecurity programs and conducting assessments, audits, or control implementation reviews in accordance with NIST Special Publications.
• Experience assessing cloud service offerings that rely on FedRAMP-authorized services and documenting control inheritance and customer responsibility requirements.
• DoD 8570/8140 IAM Level II eligibility or an equivalent qualification, when required by the customer environment.
• Experience evaluating privacy and data protection considerations as part of security assessments.

Success in this role:

The successful assessor is technically credible, independent, and evidence-driven. They know when the data supports a finding, when additional validation is needed, and when a requirement must be interpreted in light of architecture, mission use, and actual exposure. They produce assessment results that are clear, consistent, defensible, and actionable.