Senior Security Control Assessor

Apex Systems; Washington (District of Columbia); Hybrid; USD 96,000 - 165,000; Full time

Benefits offered by this job

ESPP

401K plan

Health Savings Account (HSA)

Employee Assistance Program (EAP)

Job summary

Apex Systems is seeking a Senior Cyber Security Control Assessor to support FEMA's OCISO in Washington, DC. The role is remote with an expectation to go onsite in DC as needed, on a 6+ month contract that may convert.

You will independently assess security controls, review documentation, and collaborate with system owners and ISSOs to ensure compliant, secure operations across assigned systems. Responsibilities include evaluating control design/effectiveness per NIST SP 800-53 Rev 5 and DHS RMF,

Qualifications

• Certifications such as CISSP, CISM, CISA or equivalent.
• Strong knowledge of NIST SP 800-53 Rev 5, RMF, and DHS 4300 Series.

Responsibilities

• Evaluate IT security controls and ensure compliance with NIST RMF/DHS requirements.
• Conduct comprehensive assessments using interviews, examinations, and testing.
• Review SSPs, policies, procedures, and evidence to identify gaps and residual risk.
• Generate findings for security assessment reports and support continuous monitoring.

Skills

Security certifications experience (CI

Education

Bachelor’s / Associate / No degree with experience

Tools

CSAM

RegScale

eMASS

Job description

Job#: 3053883

Job Description:

Position

Security Control Assessor (2 OPENINGS)

Location

REMOTE (w/ expectation to go onsite as needed in DC)

Duration

6+ Month Contract, possible conversion

MUST HAVES

• Authorized to work in the US (Ability to pass DHS Public Trust – heavy criminal/financial check)
• Bachelor’s & 7+ years OR Associates & 9+ years OR No Degree & 13 years
• Experience supporting federal/government security related projects

Background

Senior Cyber Security Control Assessor to support the FEMA Office of the Chief Information Security Officer (OCISO) in Washington, D.C. As a Senior Cyber Security Control Assessor, you will play a crucial role in ensuring the security and compliance of FEMA's information systems through comprehensive independent assessment of security controls. You will work in a dynamic environment, collaborating with system owners, ISSOs, stakeholders, and cybersecurity professionals to evaluate the effectiveness of security control implementation. Your efforts will directly contribute to safeguarding FEMA's mission-critical systems and data.

The Senior Cyber Security Control Assessor will serve as an independent assessor for control design, implementation, and effectiveness across assigned systems and authorization boundaries. This position requires evaluating the effectiveness of IT security controls including management, operational, and technical controls and determining if controls meet compliance requirements under NIST SP 800-53 Rev 5 and DHS RMF. The Senior Cyber Security Control Assessor will perform assessment procedures including interviews, examinations, and testing and verify control implementation and effectiveness. This role is critical for analyzing System Security Plans (SSPs), policies, procedures, and evidence artifacts to identify security gaps and evaluate residual risk. This role requires a deep understanding of cybersecurity frameworks, standards, and best practices. The assessor will work closely with various teams to identify gaps, recommend improvements, and ensure compliance with regulatory requirements.

Primary Responsibilities

• Evaluate the effectiveness of IT security controls and determine if controls meet compliance requirements under NIST SP 800-53 Rev 5 and DHS RMF.
• Performing comprehensive assessments of cybersecurity controls within a system boundary and across FEMA to include interviews, examinations, and testing to verify control implementation and effectiveness.
• Evaluate the effectiveness of existing security policies, procedures, and technologies and identify vulnerabilities and risks.
• Reviewing and analyzing System Security Plans (SSPs), policies, procedures, and evidence artifacts for completeness and accuracy, identifying security gaps and evaluating residual risk, as well as generating findings for security assessment reports.
• These assessments are a crucial function for ensuring FEMA systems maintain authority to operate standards with an acceptable level of risk.
• Develop and maintain generate the appropriate assessment artifacts and document assessment findings while supporting continuous monitoring activities and ongoing authorization efforts, highlighting findings and recommendations, and collaborate with IT, security, and business units to implement corrective actions.

Required Qualifications

• Certifications such as CISSP, CISM, CISA, or equivalent
• Strong knowledge in NIST SP 800-53, NIST SP 800-37 (RMF), and DHS 4300 Series
• Experience with security control assessment methodologies and tools
• Experience conducting security assessments and generating Security Assessment artifacts (Security Assessment Plans (SAPs), Risk Traceability Matrices (RTMs), and Security Assessment Reports (SARs))
• Strong analytical skills for identifying security gaps and evaluating residual risk
• Knowledge of assessment methodologies and risk analysis
• Experience developing POA&Ms
• Excellent analytical and problem-solving skills for vulnerability prioritization and trend analysis
• Strong communication and interpersonal skills.
• Ability to work independently and as part of a team.
• Detail-oriented with a commitment to accuracy and thoroughness.

Desired Qualifications

• Active Secret security clearance
• Experience with CSAM, RegScale, eMASS, or similar GRC tools
• Knowledge of FedRAMP assessment processes, DISA STIGs and cybersecurity compliance frameworks
• Experience with continuous monitoring and ongoing authorization activities
• Knowledge of cloud security and emerging technologies
• Strong technical writing skills for assessment documentation
• Experience supporting audit activities and authorization decisions

Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.

Everforth Apex offers a range of supplemental benefits, including medical, dental, vision, life, disability, and other insurance plans that offer an optional layer of financial protection. We offer an ESPP (employee stock purchase program) and a 401K program which allows you to contribute typically within 30 days of starting, with a company match after 12 months of tenure. Everforth Apex also offers an HSA (Health Savings Account on the HDHP plan), a SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions, a corporate discount savings program and other discounts. In terms of professional development, Everforth Apex hosts an on-demand training program, provides access to certification prep and a library of technical and leadership courses/books/seminars once you have 6+ months of tenure, and certification discounts and other perks to associations that include CompTIA and IIBA. Everforth Apex has a dedicated customer service team for our Consultants that can address questions around benefits and other resources, as well as a certified Career Coach. You can access a full list of our benefits, programs, support teams and resources within our ‘Welcome Packet’ as well, which an Everforth Apex team member can provide.

Everforth Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Everforth Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.

If you require an accommodation under the Americans with Disabilities Act to participate in an interview with a virtual recruiter or to use our website for a search or application, please contact our Benefits Department at [email protected] or 804-523-8228. Please note that this contact information is strictly to be used for medical ADA accommodations and that no other inquiries will be answered.

UnitedHealthcare creates and publishes the Transparency in Coverage Machine-Readable Files on behalf of Everforth Apex Systems.