Security Control Assessor (Mid-Level)
The Security Control Assessor (SCA) serves as the technical authority for independent security assessments supporting the NIH Office of the Director (OD), Office of Information Technology (Client). The Senior SCA leads the planning, execution, and validation of Security Control Assessments throughout the authorization lifecycle, ensuring compliance with the NIST Risk Management Framework (RMF), NIST SP 800-53 Rev. 5, and the Joint Cybersecurity Assessment Methodology (JCAM). This position maintains strict independence from authorization package development activities to preserve the objectivity and integrity of the assessment process. Work is performed primarily remotely, with occasional on-site meetings or assessment activities as required.
Key Responsibilities
- Conduct or support independent Security Control Assessments in accordance with NIST SP 800-37, NIST SP 800-53 Rev. 5, JCAM, and NIH/HHS policy.
- Review and validate authorization packages, including SSPs, SAPs, SARs, POA&Ms, Contingency Plans, and supporting evidence.
- Assess the implementation and effectiveness of security controls through documentation reviews, interviews, and technical validation.
- Review FedRAMP cloud packages and inherited controls, as applicable.
- Document findings, recommendations, and remediation activities.
- Support cybersecurity audits and continuous process improvement.
- Provide risk-based recommendations to the Authorizing Official while maintaining assessment independence.
- Mentor junior assessors and improve assessment methodologies.
Required Qualifications
Education
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related discipline. • Four (4) additional years of relevant experience may substitute for a bachelor's degree.
Experience
- Ten (10) or more years of progressive experience supporting federal cybersecurity, RMF, Security Control Assessment, security authorization, or information assurance programs.
- Demonstrated experience leading independent Security Control Assessments and validating RMF authorization packages.
- Extensive experience conducting security control testing, evidence validation, and developing SARs in accordance with NIST SP 800-37, NIST SP 800-53 Rev. 5, and JCAM.
- Experience supporting NIH, HHS, or other Federal civilian agencies is highly desirable.
- Experience reviewing FedRAMP authorization packages and supporting OIG, GAO, or independent assessments.
Preferred Qualifications
- Experience supporting NIH, HHS, or other Federal agencies.
- Experience with eMASS or similar GRC platforms.
- Familiarity with FedRAMP, NIST AI RMF, C-SCRM, and cloud security concepts.
- Experience with SSPs, SAPs, SARs, POA&Ms, and Contingency Plans.
- Experience supporting OIG, GAO, or independent cybersecurity assessments.
Desired Certifications
- ISC2 CISSP
- ISC2 CGRC
- ISACA CISM
- CompTIA CySA+
- CompTIA SecurityX (CASP+)
- GIAC GSEC
Knowledge, Skills, and Abilities
Strong knowledge of federal cybersecurity assessment principles, excellent analytical and technical writing skills, effective communication, and the ability to work collaboratively while maintaining assessment independence.
Work Environment
Primarily remote with occasional on-site meetings or assessment activities as required.