Security Control Assessor

Steampunk is seeking a Security Control Assessor to support a government customer ensuring risk within the system is maintained at an acceptable level. This role requires initiative organization strong communication across all levels of the organization and sound judgment with sensitive and confidential information in a fast-paced environment.

As a member of one of ourassessmentteams you will playan importantroleinperforming a wide array ofcybersecurity duties including:

• Lead security assessments in accordance with NIST SP 800-53 NIST RMF (SP 800-37) FedRAMP and agency-specific guidance.
• Evaluate technical operational and management controls across cloud on-premises and hybrid environments including hands-on review of technical control evidence (e.g. encryption configurations SIEM logging identity/access management network boundary controls STIG compliance).
• Develop Assessment Plans and Security Assessment Reports (SARs) and document findings and risk in compliance with FISMA FedRAMP and organizational standards.
• Coordinate with ISSOs System Owners and Authorization Officials to review evidence and remediate control deficiencies.
• Analyze vulnerability scans configuration baselines and penetration test results to determine control effectiveness and recommend remediation.
• Present findings and risk analysis to management and Authorization Officials.
• Support continuous monitoring and control validation for ongoing authorization.

• Bachelors Degree and 5 years of relevant experience; OR
  • No degree with a total of 9 years of relevant experience; OR
  • Masters degree and 3 years of relevant experience
• One of the following certifications (may be obtained within six (6) months of hire):
  • Certified Information System Security Professional (CISSP)
  • CompTIA Advanced Security Practitioner (CASP)
  • Certified Information Systems Auditor (CISA)
  • Certified Information Security Manager (CISM)
• Strong knowledge of NIST SP 800-53 FIPS 199/200 and NIST SP 800-30/37/39/53/60; familiarity with DHS Directive 4300A.
• Hands-on experience reviewing security control artifacts and providing independent evaluations for system authorization packages including in cloud environments (AWS Azure).
• Proficiency with assessment/scanning tools (e.g. Nessus Splunk SCAP scanners) and analytical skill to interpret vulnerabilities and compliance gaps.
• Demonstrated ability to review technical controls directly as a core part of the role for example: verifying FIPS-validated encryption auditing SIEM logging architecture reviewing IAM/MFA enforcement (AD Okta Azure AD) analyzing firewall/ACL/Security Group configurations and evaluating DISA STIG results.

Preferred:

• Experience as a Security Control Assessor and performing risk analysis/assessment.
• Working knowledge of AWS/Azure GovCloud and enterprise application stacks (e.g. Maven Jenkins Ansible Tomcat IIS F5 Oracle MSSQL PostgreSQL).
• Familiarity with AI/ML concepts and their security implications.
• Working knowledge of JIRA ServiceNow or equivalent.

Steampunk relies on several factors to determine salary including but not limited to geographic location contractual requirements education knowledge skills competencies and experience. The projected compensation range for this position is $105000 to $160000. The estimate displayed represents a typical annual salary range for this position. Annual salary is just one aspect of Steampunks total compensation package for employees. Learn more about additional Steampunk benefits here.

Identity Statement

As part of the application process you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Steampunk is a Change Agent in the Federal contracting industry bringing new thinking to clients in the Homeland Federal Civilian Health and DoD sectors. Through our Human-Centered delivery methodology we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission you want to learn more about our story visit .

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race color religion sex national origin disability status protected veteran status or any other characteristic protected by participates in the E-Verify program.