Senior Security Control Assessor

ANALYGENCE; Washington (District of Columbia); On-site; USD 140,000 - 170,000; Full time

Job summary

Tharros is seeking a Senior Security Control Assessor to lead the most complex RMF assessments, including CDS, SAP systems, C-LAN sites, and cloud environments. You will guide junior assessors, improve A&A SOPs, and help modernize the authorization process toward ongoing authorization and reciprocity.

This on-site role is based in a Government SCIF in Washington, DC. You will work with security teams to ensure adherence to RMF, ICD 503, CNSSI 1253, and cloud security concepts, while leveraging

Qualifications

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 10 years' experience in IT or cybersecurity.
• Minimum of 7 years' experience in RMF security control assessment.
• Active TS/SCI clearance and U.S. citizenship; willingness to undergo a DHS counterintelligence-scope polygraph.
• Knowledge of ICD 503, CNSSI 1253, and the RMF.
• Knowledge of Cross Domain Solution or SAP system assessment requirements.
• Knowledge of cloud security authorization concepts.
• Skill in using at least two security tools (e.g., Nessus/ACAS, SCAP, WebInspect, SonarQube, STIG Viewer).
• Skill in developing and improving assessment procedures and SOPs.
• Ability to lead complex assessments and mentor junior staff.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.

Responsibilities

• Lead the most complex RMF assessments in the portfolio including Cross Domain Solutions (CDS), Special Access Program (SAP) systems, C-LAN extension sites, and cloud environments.
• Guide junior assessors and improve A&A standard operating procedures; help modernize the authorization process toward ongoing authorization and reciprocity.
• Maintain on-site presence in a Government SCIF in Washington, DC; collaborate with stakeholders to address security weaknesses.
• Provide actionable recommendations to correct weaknesses or deficiencies in controls and address identified vulnerabilities.

Skills

Leadership

Mentoring

Communication

RMF knowledge

Security assessments

SOP development

MS Office/Teams

Education

BS in IT/Cybersecurity/IS/CS

10+ years IT/cybersecurity experience

Tools

Nessus/ACAS

SCAP

WebInspect

SonarQube

STIG Viewer

Job description

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise.

In support of this mission, we have an immediate opportunity for a Senior Security Control Assessor. In this role you will lead the most complex assessments in the portfolio, including Cross Domain Solutions (CDS), Special Access Program (SAP) systems, C-LAN extension sites, and cloud environments. You will guide junior assessors, improve A&A standard operating procedures, and help modernize the authorization process toward ongoing authorization and reciprocity. This position is on-site in a Government SCIF in Washington, DC.

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 10 years' experience in IT or cybersecurity.
• Minimum of 7 years' experience in RMF security control assessment.
• Active TS/SCI clearance and U.S. citizenship; willingness to undergo a DHS counterintelligence-scope polygraph.
• Knowledge of ICD 503, CNSSI 1253, and the Risk Management Framework (RMF).
• Knowledge of Cross Domain Solution or SAP system assessment requirements.
• Knowledge of cloud security authorization concepts.
• Skill in using at least two security tools (e.g., Nessus/ACAS, SCAP, WebInspect, SonarQube, STIG Viewer).
• Skill in developing and improving assessment procedures and SOPs.
• Ability to lead complex assessments and mentor junior staff.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.

• Must have an active TS/ SCI
• Requires 7-10 years related experience.
• Must be able to assess the security controls employed within and inherited by an information system using assessment procedures specified in the security assessment plan.
• Must be able to provide specific recommendations on how to correct weaknesses or deficiencies in the controls and address identified vulnerabilities.
• Excellent written and verbal communication skills.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.