Senior Security Controls Assessor – RMF, NIST, SA&A

ECS; Washington (District of Columbia); Hybrid; USD 150,000 - 168,000; Full time

Job summary

Everforth ECS in Washington, DC (hybrid) seeks a Security Controls Assessor to perform independent security and privacy control assessments for a federal client. Responsibilities include reviewing SSPs, risk assessments, and ISCPs, and developing test cases and assessment plans in line with NIST RMF and SP 800-53A.

The role requires an active Secret clearance, five years in information security, and experience with RMF 1-6 and A&A processes. Occasional travel is required.

Qualifications

• Active Secret clearance with eligibility for Top Secret
• Bachelor's degree in CS / MIS / IT / Eng / InfoSec or related field
• Minimum five years information security experience
• Minimum three years supporting security assessment teams, including planning assessments
• Two years of experience using GRC tools
• Experience conducting full-scope security control testing across component types
• Working knowledge of RMF Steps 1-6
• Strong understanding of NIST SP 800-53, CSF, and related laws
• Ability to analyze system configurations against NIST SP 800-53
• Experience developing risk-based documentation
• Excellent written and verbal communication skills

Responsibilities

• Review and update information security policies, standards, and procedures per regulations
• Perform independent security and privacy control assessments for client SA&A
• Assess existing and new FISMA systems and communicate findings
• Review A&A packages: SSPs, Risk Assessments, ISCP, IRP, CMP, inventories, diagrams, POA&Ms
• Develop and maintain test cases for control testing across components
• Develop and execute security and privacy assessment plans per NIST SP 800-53A
• Document findings clearly, with actionable recommendations
• Analyze tool outputs to distinguish residual risk from false positives
• Travel CONUS and OCONUS for assessments
• Other duties as assigned

Skills

Active Secret clearance

Bachelor's degree in CS / MIS/IT / Eng

5+ years information security

3+ years security assessments support

2+ years with GRC tools

Full-scope security control testing

RMF Steps 1-6

NIST 800-53 / CSF knowledge

Analyze configurations for NIST

Risk-based documentation

Excellent written & verbal comms

Education

Bachelor's degree in Computer Science, MIS/IT, Engineering, Information Security/Assurance, or related field

Job description

Everforth ECS in Washington, DC (hybrid) seeks a Security Controls Assessor to perform independent security and privacy control assessments for a federal client. Responsibilities include reviewing SSPs, risk assessments, and ISCPs, and developing test cases and assessment plans in line with NIST RMF and SP 800-53A.

The role requires an active Secret clearance, five years in information security, and experience with RMF 1-6 and A&A processes. Occasional travel is required.