Senior Security Control Assessor - RMF & DoD IA Expert

Integrity Solutions, Engineering, and Analytics Corporation; Virginia (MN, MD); On-site; USD 110,000 - 170,000; Full time

Job summary

ISEA is seeking an experienced Security Control Assessor to independently validate security postures under RMF, ICD 503 and CNSSI 1253. The role spans cloud, on‑prem, and hybrid environments, delivering risk‑based recommendations to authorizing officials.

Candidates should have 5–10+ years in information assurance or DoD RMF, DoD 8140/8570 certs (CISSP, CISA, CGRC), and familiarity with Xacta, ACAS/Nessus, and STIG Viewer; strong technical writing is essential.

Qualifications

• 5-10+ years in information assurance, cybersecurity assessment, or IT auditing, RMF focus in DoD/IC.
• Bachelor’s or Master’s degree in Cybersecurity, CS, IT, or related technical discipline.
• Active DoD 8140/8570 certifications (IAM III or IAT III): CISSP, CISA, CGRC.
• Mastery of ICD 503, CNSSI 1253, and NIST SP 800-37/53/53A.
• Proficiency with Xacta, ACAS/Nessus, SCC, and STIG Viewer.

Responsibilities

• Plan and conduct security control assessments based on NIST SP 800-53 and CNSSI 1253.
• Perform hands-on and automated validation of controls; review configurations, logs, access controls, network boundaries.
• Use vulnerability scanning tools and STIGs to test resilience of cloud, on-premise, and hybrid environments.
• Evaluate BoE packages (SSP, CONOPS, network diagrams) for accuracy and completeness.
• Translate vulnerabilities into risk assessments for Authorizing Official (AO) and guide remediation with system teams.
• Support continuous monitoring through reviews of periodic assessments and vulnerability data.

Skills

RMF

Info Assurance

Cybersecurity

Education

Bachelors/Masters in CS/IT

Tools

Xacta

ACAS/Nessus

SCAP Checker

STIG Viewer

Job description

ISEA is seeking an experienced Security Control Assessor to independently validate security postures under RMF, ICD 503 and CNSSI 1253. The role spans cloud, on‑prem, and hybrid environments, delivering risk‑based recommendations to authorizing officials.

Candidates should have 5–10+ years in information assurance or DoD RMF, DoD 8140/8570 certs (CISSP, CISA, CGRC), and familiarity with Xacta, ACAS/Nessus, and STIG Viewer; strong technical writing is essential.