Senior RMF Security Control Assessor

MSCCN; Oak Park (TN); On-site; USD 90,000 - 130,000; Full time

Job summary

CNS is seeking a Security Control Assessor to evaluate Federal information systems in support of RMF A&A processes. You will conduct comprehensive control assessments, document findings, and provide remediation guidance to ISSOs and system owners.

The role requires strong analytical skills, excellent written and verbal communication, and the ability to present complex findings to technical and non-technical stakeholders.

Qualifications

• Bachelor's degree in engineering, computer science, math, IT or related discipline.
• Eight or more years of relevant education, training and/or progressive experience.

Responsibilities

• Conduct security control assessments per NIST SP 800-53A and organizational methods.
• Evaluate implementation and effectiveness of controls against baselines and NIST standards.
• Develop and document assessment reports with findings, evidence and risk determinations.
• Perform gap analyses identifying deficiencies and remediation needs.
• Collaborate with ISSOs and system teams to gather evidence and validate controls.
• Support SSPs and assessment documentation; review POA&Ms for remediation strategies.
• Assess security impact of system changes and control modifications; participate in reviews.
• Maintain knowledge of NIST standards and RMF practices; communicate findings clearly.

Skills

Security control assessments

NIST RMF

A&A processes

Documentation & reporting

Communication skills

Networking concepts

Education

Bachelor's degree in engineering or related discipline

8+ years of related education/experience

Job description

CNS is seeking a Security Control Assessor to evaluate Federal information systems in support of RMF A&A processes. You will conduct comprehensive control assessments, document findings, and provide remediation guidance to ISSOs and system owners.

The role requires strong analytical skills, excellent written and verbal communication, and the ability to present complex findings to technical and non-technical stakeholders.