Security Controls Assessor

ECS is seeking a Security Controls Assessor to work in our Washington, DC (hybrid) office. Please Note: This position is contingent upon contract award.

ECS seeks a Security Controls Assessor to support a full range of cybersecurity services on a long-term, full-time contract with a U.S. Government civilian agency. This position requires mostly CONUS and occasional OCONUS assessments and is available immediately for a qualified candidate with an active security clearance.

Key Responsibilities

• Review and update information security policies, standards, and procedures in accordance with federal and departmental regulations
• Perform independent security and privacy control assessments on behalf of the client CSO in support of Security Assessment & Authorization (SA&A)
• Assess existing and new FISMA systems and subsystems, and communicate findings and potential impacts of identified control weaknesses
• Review and analyze A&A packages-including System Security Plans (SSP), Risk Assessments, Information System Contingency Plans (ISCP), Backup SOPs, Incident Response Plans (IRP), Configuration Management Plans (CMP), hardware/software inventories, network diagrams, data flows, system change requests, vulnerability scan reports, test reports, and POA&Ms-for completeness, accuracy, and effective control implementation
• Develop and maintain test cases for control-level security testing across system components (applications, servers, databases, operating systems, network devices, end-user devices, etc.)
• Develop and execute security and privacy assessment plans in accordance with NIST SP 800-53A, supporting RMF Steps 4-6
• Document findings and recommendations that are clear, system-specific, and actionable
• Analyze security tool outputs to distinguish residual risk from false positives prior to finalizing findings
• CONUS and OCONUS travel to conduct system assessments
• Other duties as assigned

Salary Range: $150,000-$168,000

General Description of Benefits